diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 522f10b..6fe92a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,14 +2,14 @@ name: CI
 
 on:
   push:
+  pull_request:
 
 jobs:
-  lint:
-    name: "Lint Code"
+  build:
+    name: "Build & Test"
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v5
       - uses: pnpm/action-setup@v4
@@ -20,5 +20,24 @@ jobs:
         with:
           node-version: ${{ vars.NODEJS_VERSION }}
           cache: 'pnpm'
+
       - run: pnpm install
-      - run: pnpm run lint
\ No newline at end of file
+
+      # Drift check: regenerate the low-level layer from the vendored spec and
+      # fail if the committed output is stale. The generated code under
+      # `src/gen/` must always match `spec/client.yaml`.
+      - name: Generate client layer
+        run: pnpm generate
+      - name: Verify generated code is up to date
+        run: |
+          git diff --exit-code src/gen || {
+            echo "::error::Generated code in src/gen is out of date. Run 'pnpm generate' and commit the result."
+            exit 1
+          }
+
+      - name: Build
+        run: pnpm run build
+      - name: Lint
+        run: pnpm run lint
+      - name: Test
+        run: pnpm test
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index e05b6e8..b27e305 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -25,3 +25,4 @@ jobs:
         env:
           LUNOGRAM_API_KEY: ${{ secrets.LUNOGRAM_API_KEY }}
           LUNOGRAM_API_URL: ${{ secrets.LUNOGRAM_API_URL }}
+          LUNOGRAM_PROJECT_ID: ${{ secrets.LUNOGRAM_PROJECT_ID }}
diff --git a/README.md b/README.md
index d0fc288..c4f9268 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,8 @@ npm install @lunogram/js-sdk
 ```typescript
 import { Lunogram } from '@lunogram/js-sdk'
 
-const lunogram = new Lunogram('your-api-key')
+// The project UUID is required and scopes every request to that project.
+const lunogram = new Lunogram('your-api-key', 'your-project-uuid')
 
 // Identify a user
 await lunogram.user.upsert({
@@ -46,6 +47,32 @@ await lunogram.organization.upsert({
 })
 ```
 
+## Project Scoping
+
+Every Lunogram Client API request is scoped to a single **project**. You supply
+the project UUID once, when constructing the client, and the SDK injects it into
+every request path automatically — you never pass it per call.
+
+All Client API endpoints live under `/api/client/projects/{projectId}/...`:
+
+| Operation                | Path                                                              |
+| ------------------------ | ----------------------------------------------------------------- |
+| Users                    | `/api/client/projects/{projectId}/users`                          |
+| User events              | `/api/client/projects/{projectId}/users/events`                   |
+| User scheduled           | `/api/client/projects/{projectId}/users/scheduled`                |
+| User inbox               | `/api/client/projects/{projectId}/users/inbox`                    |
+| User devices             | `/api/client/projects/{projectId}/users/devices`                  |
+| Organizations            | `/api/client/projects/{projectId}/organizations`                  |
+| Organization members     | `/api/client/projects/{projectId}/organizations/users`            |
+| Organization events      | `/api/client/projects/{projectId}/organizations/events`           |
+| Organization scheduled   | `/api/client/projects/{projectId}/organizations/scheduled`        |
+| Organization inbox       | `/api/client/projects/{projectId}/organizations/inbox`            |
+| Push (VAPID key)         | `/api/client/projects/{projectId}/push/vapid`                     |
+| Sessions                 | `/api/client/projects/{projectId}/auth-methods/{authMethodId}/sessions` |
+
+The `projectId` must be a valid UUID; the client throws a `ValidationError` at
+construction time if it is missing, empty, or malformed.
+
 ## Identity Model
 
 Users and organizations are identified by an array of `ExternalID` objects:
@@ -69,7 +96,10 @@ The SDK automatically generates an anonymous identifier for each session. When y
 ```typescript
 import { BrowserClient } from '@lunogram/js-sdk'
 
-const client = new BrowserClient({ apiKey: 'your-api-key' })
+const client = new BrowserClient({
+    apiKey: 'your-api-key',
+    projectId: 'your-project-uuid',
+})
 
 // anonymousId is auto-generated
 client.user.anonymousId
@@ -100,7 +130,7 @@ The SDK is also exposed on `window.Lunogram`:
 
 ```html
 <script>
-    const lunogram = new Lunogram('your-api-key')
+    const lunogram = new Lunogram('your-api-key', 'your-project-uuid')
     lunogram.user.upsert({
         identifier: [{ externalId: 'user-123' }],
         email: 'user@example.com',
@@ -115,6 +145,7 @@ import { Client } from '@lunogram/js-sdk'
 
 const client = new Client({
     apiKey: 'your-api-key',
+    projectId: 'your-project-uuid', // required — scopes all requests to this project
     urlEndpoint: 'https://your-api.com/api', // optional
 })
 
@@ -179,6 +210,76 @@ await client.organization.schedule.upsert({
 })
 ```
 
+### Inbox
+
+Create, query, count and update inbox messages for users and organizations. The
+same surface is available under `client.organization.inbox.*`.
+
+```typescript
+// Create inbox messages (max 100 per call)
+await client.user.inbox.create([
+    {
+        target: [{ externalId: 'user-123' }],
+        identifier: { externalId: 'msg-1' },
+        channel: 'inbox',
+        content: { title: 'Welcome', body: 'Thanks for joining!' },
+    },
+])
+
+// Query a user's visible messages
+const { results, total } = await client.user.inbox.query({
+    source: 'default',
+    externalId: 'user-123',
+    channel: 'inbox',
+    status: 'unread',
+})
+
+// Unread / total counts
+const counts = await client.user.inbox.count({
+    source: 'default',
+    externalId: 'user-123',
+    channel: 'inbox',
+})
+
+// Mark messages read / archived
+await client.user.inbox.markRead([{ target: [{ externalId: 'user-123' }], messageId: 'msg-1' }])
+await client.user.inbox.markArchived([{ target: [{ externalId: 'user-123' }], messageId: 'msg-1' }])
+```
+
+### Devices & Push
+
+Register a device's push subscription and fetch the project's VAPID public key
+for Web Push. In the browser, the current session identifier is injected
+automatically.
+
+```typescript
+const { publicKey } = await client.push.getVapidPublicKey()
+
+await client.user.devices.register({
+    identifier: [{ externalId: 'user-123' }],
+    deviceId: 'device-1',
+    os: 'web',
+    config: {
+        endpoint: 'https://push.example.com/...',
+        keys: { p256dh: '...', auth: '...' },
+    },
+})
+```
+
+### Sessions
+
+Mint a short-lived session token for an end user, server-side, so the client can
+call the Client API directly. The permissions are defined by the session auth
+method (policy) named in the call.
+
+```typescript
+const session = await client.sessions.create('auth-method-uuid', {
+    userId: 'user-123',
+})
+
+// session.token is a bearer token for the Client API; session.expiresAt is its expiry
+```
+
 ### Multiple Identifiers
 
 You can pass multiple identifiers from different sources:
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 7cd1878..ae0f9b9 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -8,6 +8,9 @@ export default defineConfig(
   eslint.configs.recommended,
   tseslint.configs.recommended,
   {
-    ignores: ["lib/**", "node_modules/**", "dist/**"],
+    // `src/gen/**` is auto-generated by `pnpm generate` (openapi-typescript)
+    // and must not be hand-edited; exclude it from linting rather than tweaking
+    // the generated output.
+    ignores: ["lib/**", "node_modules/**", "dist/**", "src/gen/**"],
   },
 );
diff --git a/package.json b/package.json
index b721ce7..4b0e8b9 100644
--- a/package.json
+++ b/package.json
@@ -7,10 +7,12 @@
     "url": "https://github.com/lunogram/js-sdk"
   },
   "scripts": {
+    "generate": "openapi-typescript spec/client.yaml -o src/gen/schema.ts",
     "build": "rimraf lib/ && pnpm run build:esm && pnpm run build:cjs",
     "build:esm": "tsc --project ./tsconfig.module.json",
     "build:cjs": "tsc --project ./tsconfig.json",
     "lint": "eslint . --ext .ts",
+    "test": "vitest run test/url.test.ts test/browser.test.ts",
     "test:e2e": "vitest run test/e2e.test.ts",
     "release:github": "pnpm publish --no-git-checks --registry=https://npm.pkg.github.com",
     "release:npm": "npm publish --access public --registry=https://registry.npmjs.org"
@@ -50,6 +52,7 @@
     "@eslint/js": "^9.37.0",
     "@types/uuid": "^10.0.0",
     "eslint": "^9.37.0",
+    "openapi-typescript": "^7.13.0",
     "rimraf": "^6.0.1",
     "typescript": "^5.6.2",
     "typescript-eslint": "^8.46.0",
@@ -59,6 +62,7 @@
     "lib"
   ],
   "dependencies": {
+    "openapi-fetch": "^0.17.0",
     "tslib": "^2.8.1",
     "uuid": "^13.0.0"
   }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1553e97..d1742d2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8,6 +8,9 @@ importers:
 
   .:
     dependencies:
+      openapi-fetch:
+        specifier: ^0.17.0
+        version: 0.17.0
       tslib:
         specifier: ^2.8.1
         version: 2.8.1
@@ -24,6 +27,9 @@ importers:
       eslint:
         specifier: ^9.37.0
         version: 9.37.0
+      openapi-typescript:
+        specifier: ^7.13.0
+        version: 7.13.0(typescript@5.9.3)
       rimraf:
         specifier: ^6.0.1
         version: 6.0.1
@@ -39,6 +45,14 @@ importers:
 
 packages:
 
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
   '@emnapi/core@1.9.1':
     resolution: {integrity: sha512-mukuNALVsoix/w1BJwFzwXBN/dHeejQtuVzcDsfOEsdpCumXb/E9j8w11h5S54tT1xhifGfbbSm/ICrObRb3KA==}
 
@@ -138,6 +152,16 @@ packages:
   '@oxc-project/types@0.122.0':
     resolution: {integrity: sha512-oLAl5kBpV4w69UtFZ9xqcmTi+GENWOcPF7FCrczTiBbmC0ibXxCwyvZGbO39rCVEuLGAZM84DH0pUIyyv/YJzA==}
 
+  '@redocly/ajv@8.11.2':
+    resolution: {integrity: sha512-io1JpnwtIcvojV7QKDUSIuMN/ikdOUd1ReEnUnMKGfDVridQZ31J0MmIuqwuRjWDZfmvr+Q0MqCcfHM2gTivOg==}
+
+  '@redocly/config@0.22.0':
+    resolution: {integrity: sha512-gAy93Ddo01Z3bHuVdPWfCwzgfaYgMdaZPcfL7JZ7hWJoK9V0lXDbigTWkhiPFAaLWzbOJ+kbUQG1+XwIm0KRGQ==}
+
+  '@redocly/openapi-core@1.34.15':
+    resolution: {integrity: sha512-HAwCnNyKcs5XGQqms+9t7OdAPM/5TDstmhF+0i7tdCFato2QKuYIlyWETwkXd8c5zbltr1oB+6y9NTeQLr2d6Q==}
+    engines: {node: '>=18.17.0', npm: '>=9.5.0'}
+
   '@rolldown/binding-android-arm64@1.0.0-rc.12':
     resolution: {integrity: sha512-pv1y2Fv0JybcykuiiD3qBOBdz6RteYojRFY1d+b95WVuzx211CRh+ytI/+9iVyWQ6koTh5dawe4S/yRfOFjgaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -349,9 +373,17 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
+  agent-base@7.1.4:
+    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
+    engines: {node: '>= 14'}
+
   ajv@6.12.6:
     resolution: {integrity: sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==}
 
+  ansi-colors@4.1.3:
+    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
+    engines: {node: '>=6'}
+
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
@@ -400,6 +432,9 @@ packages:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
 
+  change-case@5.4.4:
+    resolution: {integrity: sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==}
+
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -407,6 +442,9 @@ packages:
   color-name@1.1.4:
     resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
 
+  colorette@1.4.0:
+    resolution: {integrity: sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==}
+
   concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
@@ -575,6 +613,10 @@ packages:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
 
+  https-proxy-agent@7.0.6:
+    resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
+    engines: {node: '>= 14'}
+
   ignore@5.3.2:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
@@ -591,6 +633,10 @@ packages:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
 
+  index-to-position@1.2.0:
+    resolution: {integrity: sha512-Yg7+ztRkqslMAS2iFaU+Oa4KTSidr63OsFGlOrJoW981kIYO3CGCS3wA95P1mUi/IVSJkn0D479KTJpVpvFNuw==}
+    engines: {node: '>=18'}
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -614,16 +660,30 @@ packages:
     resolution: {integrity: sha512-zptv57P3GpL+O0I7VdMJNBZCu+BPHVQUk55Ft8/QCJjTVxrnJHuVuX/0Bl2A6/+2oyR/ZMEuFKwmzqqZ/U5nPQ==}
     engines: {node: 20 || >=22}
 
+  js-levenshtein@1.1.6:
+    resolution: {integrity: sha512-X2BB11YZtrRqY4EnQcLX5Rh373zbK4alC1FW7D7MBhL2gtcC17cTnr6DmfHZeS0s2rTHjUTMMHfG7gO8SSdw+g==}
+    engines: {node: '>=0.10.0'}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
   js-yaml@4.1.0:
     resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
     hasBin: true
 
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
   json-buffer@3.0.1:
     resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
 
   json-schema-traverse@0.4.1:
     resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
 
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
@@ -733,6 +793,10 @@ packages:
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
 
+  minimatch@5.1.9:
+    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
+    engines: {node: '>=10'}
+
   minimatch@9.0.5:
     resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
     engines: {node: '>=16 || 14 >=14.17'}
@@ -755,6 +819,18 @@ packages:
   obug@2.1.1:
     resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
 
+  openapi-fetch@0.17.0:
+    resolution: {integrity: sha512-PsbZR1wAPcG91eEthKhN+Zn92FMHxv+/faECIwjXdxfTODGSGegYv0sc1Olz+HYPvKOuoXfp+0pA2XVt2cI0Ig==}
+
+  openapi-typescript-helpers@0.1.0:
+    resolution: {integrity: sha512-OKTGPthhivLw/fHz6c3OPtg72vi86qaMlqbJuVJ23qOvQ+53uw1n7HdmkJFibloF7QEjDrDkzJiOJuockM/ljw==}
+
+  openapi-typescript@7.13.0:
+    resolution: {integrity: sha512-EFP392gcqXS7ntPvbhBzbF8TyBA+baIYEm791Hy5YkjDYKTnk/Tn5OQeKm5BIZvJihpp8Zzr4hzx0Irde1LNGQ==}
+    hasBin: true
+    peerDependencies:
+      typescript: ^5.x
+
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
@@ -774,6 +850,10 @@ packages:
     resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
     engines: {node: '>=6'}
 
+  parse-json@8.3.0:
+    resolution: {integrity: sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ==}
+    engines: {node: '>=18'}
+
   path-exists@4.0.0:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
@@ -800,6 +880,10 @@ packages:
     resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
+  pluralize@8.0.0:
+    resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
+    engines: {node: '>=4'}
+
   postcss@8.5.8:
     resolution: {integrity: sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==}
     engines: {node: ^10 || ^12 || >=14}
@@ -815,6 +899,10 @@ packages:
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -886,6 +974,10 @@ packages:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
+  supports-color@10.2.2:
+    resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
+    engines: {node: '>=18'}
+
   supports-color@7.2.0:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
@@ -922,6 +1014,10 @@ packages:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
 
+  type-fest@4.41.0:
+    resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
+    engines: {node: '>=16'}
+
   typescript-eslint@8.46.0:
     resolution: {integrity: sha512-6+ZrB6y2bT2DX3K+Qd9vn7OFOJR+xSLDj+Aw/N3zBwUt27uTw2sw2TE2+UcY1RiyBZkaGbTkVg9SSdPNUG6aUw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -934,6 +1030,9 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  uri-js-replace@1.0.1:
+    resolution: {integrity: sha512-W+C9NWNLFOoBI2QWDp4UT9pv65r2w5Cx+3sTYFvtMdDBxkKt1syCqsUdSFAChbEe1uK5TfS04wt/nGwmaeIQ0g==}
+
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
@@ -1041,12 +1140,27 @@ packages:
     resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
     engines: {node: '>=12'}
 
+  yaml-ast-parser@0.0.43:
+    resolution: {integrity: sha512-2PTINUwsRqSd+s8XxKaJWQlUuEMHJQyEuh2edBbW8KNJz0SJPwUSD2zRWqezFEdN7IzAgeuYHFUCF7o8zRdZ0A==}
+
+  yargs-parser@21.1.1:
+    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
+    engines: {node: '>=12'}
+
   yocto-queue@0.1.0:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
 snapshots:
 
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
   '@emnapi/core@1.9.1':
     dependencies:
       '@emnapi/wasi-threads': 1.2.0
@@ -1073,7 +1187,7 @@ snapshots:
   '@eslint/config-array@0.21.0':
     dependencies:
       '@eslint/object-schema': 2.1.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -1089,7 +1203,7 @@ snapshots:
   '@eslint/eslintrc@3.3.1':
     dependencies:
       ajv: 6.12.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -1158,6 +1272,29 @@ snapshots:
 
   '@oxc-project/types@0.122.0': {}
 
+  '@redocly/ajv@8.11.2':
+    dependencies:
+      fast-deep-equal: 3.1.3
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+      uri-js-replace: 1.0.1
+
+  '@redocly/config@0.22.0': {}
+
+  '@redocly/openapi-core@1.34.15(supports-color@10.2.2)':
+    dependencies:
+      '@redocly/ajv': 8.11.2
+      '@redocly/config': 0.22.0
+      colorette: 1.4.0
+      https-proxy-agent: 7.0.6(supports-color@10.2.2)
+      js-levenshtein: 1.1.6
+      js-yaml: 4.1.1
+      minimatch: 5.1.9
+      pluralize: 8.0.0
+      yaml-ast-parser: 0.0.43
+    transitivePeerDependencies:
+      - supports-color
+
   '@rolldown/binding-android-arm64@1.0.0-rc.12':
     optional: true
 
@@ -1253,7 +1390,7 @@ snapshots:
       '@typescript-eslint/types': 8.46.0
       '@typescript-eslint/typescript-estree': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/visitor-keys': 8.46.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       eslint: 9.37.0
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -1263,7 +1400,7 @@ snapshots:
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/types': 8.46.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -1282,7 +1419,7 @@ snapshots:
       '@typescript-eslint/types': 8.46.0
       '@typescript-eslint/typescript-estree': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/utils': 8.46.0(eslint@9.37.0)(typescript@5.9.3)
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       eslint: 9.37.0
       ts-api-utils: 2.1.0(typescript@5.9.3)
       typescript: 5.9.3
@@ -1297,7 +1434,7 @@ snapshots:
       '@typescript-eslint/tsconfig-utils': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/types': 8.46.0
       '@typescript-eslint/visitor-keys': 8.46.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
@@ -1370,6 +1507,8 @@ snapshots:
 
   acorn@8.15.0: {}
 
+  agent-base@7.1.4: {}
+
   ajv@6.12.6:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -1377,6 +1516,8 @@ snapshots:
       json-schema-traverse: 0.4.1
       uri-js: 4.4.1
 
+  ansi-colors@4.1.3: {}
+
   ansi-regex@5.0.1: {}
 
   ansi-regex@6.2.2: {}
@@ -1415,12 +1556,16 @@ snapshots:
       ansi-styles: 4.3.0
       supports-color: 7.2.0
 
+  change-case@5.4.4: {}
+
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
 
   color-name@1.1.4: {}
 
+  colorette@1.4.0: {}
+
   concat-map@0.0.1: {}
 
   convert-source-map@2.0.0: {}
@@ -1431,9 +1576,11 @@ snapshots:
       shebang-command: 2.0.0
       which: 2.0.2
 
-  debug@4.4.3:
+  debug@4.4.3(supports-color@10.2.2):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 10.2.2
 
   deep-is@0.1.4: {}
 
@@ -1476,7 +1623,7 @@ snapshots:
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       escape-string-regexp: 4.0.0
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -1595,6 +1742,13 @@ snapshots:
 
   has-flag@4.0.0: {}
 
+  https-proxy-agent@7.0.6(supports-color@10.2.2):
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
   ignore@5.3.2: {}
 
   ignore@7.0.5: {}
@@ -1606,6 +1760,8 @@ snapshots:
 
   imurmurhash@0.1.4: {}
 
+  index-to-position@1.2.0: {}
+
   is-extglob@2.1.1: {}
 
   is-fullwidth-code-point@3.0.0: {}
@@ -1622,14 +1778,24 @@ snapshots:
     dependencies:
       '@isaacs/cliui': 8.0.2
 
+  js-levenshtein@1.1.6: {}
+
+  js-tokens@4.0.0: {}
+
   js-yaml@4.1.0:
     dependencies:
       argparse: 2.0.1
 
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
   json-buffer@3.0.1: {}
 
   json-schema-traverse@0.4.1: {}
 
+  json-schema-traverse@1.0.0: {}
+
   json-stable-stringify-without-jsonify@1.0.1: {}
 
   keyv@4.5.4:
@@ -1717,6 +1883,10 @@ snapshots:
     dependencies:
       brace-expansion: 1.1.12
 
+  minimatch@5.1.9:
+    dependencies:
+      brace-expansion: 2.0.2
+
   minimatch@9.0.5:
     dependencies:
       brace-expansion: 2.0.2
@@ -1731,6 +1901,22 @@ snapshots:
 
   obug@2.1.1: {}
 
+  openapi-fetch@0.17.0:
+    dependencies:
+      openapi-typescript-helpers: 0.1.0
+
+  openapi-typescript-helpers@0.1.0: {}
+
+  openapi-typescript@7.13.0(typescript@5.9.3):
+    dependencies:
+      '@redocly/openapi-core': 1.34.15(supports-color@10.2.2)
+      ansi-colors: 4.1.3
+      change-case: 5.4.4
+      parse-json: 8.3.0
+      supports-color: 10.2.2
+      typescript: 5.9.3
+      yargs-parser: 21.1.1
+
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -1754,6 +1940,12 @@ snapshots:
     dependencies:
       callsites: 3.1.0
 
+  parse-json@8.3.0:
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      index-to-position: 1.2.0
+      type-fest: 4.41.0
+
   path-exists@4.0.0: {}
 
   path-key@3.1.1: {}
@@ -1771,6 +1963,8 @@ snapshots:
 
   picomatch@4.0.4: {}
 
+  pluralize@8.0.0: {}
+
   postcss@8.5.8:
     dependencies:
       nanoid: 3.3.11
@@ -1783,6 +1977,8 @@ snapshots:
 
   queue-microtask@1.2.3: {}
 
+  require-from-string@2.0.2: {}
+
   resolve-from@4.0.0: {}
 
   reusify@1.1.0: {}
@@ -1860,6 +2056,8 @@ snapshots:
 
   strip-json-comments@3.1.1: {}
 
+  supports-color@10.2.2: {}
+
   supports-color@7.2.0:
     dependencies:
       has-flag: 4.0.0
@@ -1889,6 +2087,8 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
+  type-fest@4.41.0: {}
+
   typescript-eslint@8.46.0(eslint@9.37.0)(typescript@5.9.3):
     dependencies:
       '@typescript-eslint/eslint-plugin': 8.46.0(@typescript-eslint/parser@8.46.0(eslint@9.37.0)(typescript@5.9.3))(eslint@9.37.0)(typescript@5.9.3)
@@ -1902,6 +2102,8 @@ snapshots:
 
   typescript@5.9.3: {}
 
+  uri-js-replace@1.0.1: {}
+
   uri-js@4.4.1:
     dependencies:
       punycode: 2.3.1
@@ -1969,4 +2171,8 @@ snapshots:
       string-width: 5.1.2
       strip-ansi: 7.1.2
 
+  yaml-ast-parser@0.0.43: {}
+
+  yargs-parser@21.1.1: {}
+
   yocto-queue@0.1.0: {}
diff --git a/spec/SOURCE.md b/spec/SOURCE.md
new file mode 100644
index 0000000..8ea86fe
--- /dev/null
+++ b/spec/SOURCE.md
@@ -0,0 +1,32 @@
+# Spec source
+
+`spec/client.yaml` is **vendored** (committed) from a Lunogram platform
+**release**. The SDK's low-level layer (`src/gen/schema.ts`) is generated from
+it via `pnpm generate`. Do not hand-edit either file.
+
+| Field       | Value                                |
+| ----------- | ------------------------------------ |
+| Source repo | https://github.com/lunogram/platform |
+| Pinned tag  | `v0.1.0-rc.1`                        |
+| Spec asset  | `client.yaml`                        |
+
+Release asset URL to re-fetch the spec:
+
+```
+https://github.com/lunogram/platform/releases/download/v0.1.0-rc.1/client.yaml
+```
+
+## About the pin
+
+The SDK pins a specific platform **release tag**. Every tagged platform release
+publishes the client OpenAPI spec as a `client.yaml` asset (see the platform's
+`.github/workflows/release.yml` → `openapi-specs` job), so the spec is fetched
+from a stable, versioned, immutable source — no platform checkout or branch pin
+required.
+
+## How to bump the pin
+
+1. Update the **Pinned tag** value above and the release asset URL to the new tag.
+2. Re-fetch the spec into `spec/client.yaml` from the release asset URL above.
+3. Run `pnpm generate` to regenerate `src/gen/schema.ts`.
+4. Commit `spec/` and `src/gen/` together.
diff --git a/spec/client.yaml b/spec/client.yaml
new file mode 100644
index 0000000..5bdf2ca
--- /dev/null
+++ b/spec/client.yaml
@@ -0,0 +1,1779 @@
+openapi: 3.0.3
+info:
+  title: Lunogram Public API
+  description: API for ingesting data such as user profiles and events.
+  version: 1.0.0
+
+paths:
+  /api/client/projects/{projectID}/users:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert user
+      description: Used by client libraries to create or update a user profile. The project is taken from the projectID path parameter.
+      operationId: upsertUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/IdentifyRequest"
+      responses:
+        "200":
+          description: User upserted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete user
+      description: |
+        Used by client libraries to delete a user by external_id or anonymous_id.
+        The project is taken from the projectID path parameter.
+      operationId: deleteUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteUserRequest"
+      responses:
+        "204":
+          description: User deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/events:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Post user events
+      description: |
+        Used by client libraries to trigger events for a user that can be used to execute a step in a journey or update a virtual list.
+        Multiple events can be sent in a single request and are processed asynchronously.
+        Each event is handled independently: if one event fails to be accepted or processed, other events in the same request may still be published successfully.
+        Clients requiring deterministic retry or recovery behavior must submit events individually.
+        The project is taken from the projectID path parameter.
+      operationId: postUserEvents
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostEventsRequest"
+      responses:
+        "202":
+          description: Events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Create user inbox messages
+      description: Creates one or more inbox messages for users identified by external identifiers. Messages are processed asynchronously.
+      operationId: postUserInboxMessages
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostUserInboxMessagesRequest"
+      responses:
+        "202":
+          description: Inbox messages accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+    get:
+      summary: Query user inbox messages
+      description: Returns visible, non-expired inbox messages for a user identified by source and external_id.
+      operationId: getUserInbox
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: status
+          in: query
+          schema:
+            type: string
+            enum: [unread, read, archived]
+        - name: tags
+          in: query
+          schema:
+            type: string
+          description: Comma-separated tag filter. All listed tags must be present.
+        - name: message_source
+          in: query
+          schema:
+            type: string
+        - name: priority
+          in: query
+          schema:
+            type: integer
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+        - $ref: "#/components/parameters/Limit"
+        - $ref: "#/components/parameters/Offset"
+      responses:
+        "200":
+          description: User inbox messages retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxMessageList"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox/count:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    get:
+      summary: Count user inbox messages
+      description: Returns unread and total visible inbox message counts for a user.
+      operationId: getUserInboxCount
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+      responses:
+        "200":
+          description: User inbox count retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxCount"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox/read:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark user inbox messages read
+      description: Marks one or more user inbox messages as read. Processed asynchronously.
+      operationId: postUserInboxRead
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UserInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox read events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox/archived:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark user inbox messages archived
+      description: Marks one or more user inbox messages as archived. Processed asynchronously.
+      operationId: postUserInboxArchived
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UserInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox archived events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert organization
+      description: |
+        Used by client libraries to create or update an organization by external_id.
+        The project is taken from the projectID path parameter.
+      operationId: upsertOrganizationClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationRequest"
+      responses:
+        "200":
+          description: Organization upserted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Organization"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete organization
+      description: |
+        Used by client libraries to delete an organization by external_id.
+        This will also remove all organization memberships.
+        The project is taken from the projectID path parameter.
+      operationId: deleteOrganizationClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteOrganizationRequest"
+      responses:
+        "204":
+          description: Organization deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/users:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Add user to organization
+      description: |
+        Used by client libraries to add a user to an organization with optional org-specific data.
+        Both organization and user are identified by their external_id.
+        The project is taken from the projectID path parameter.
+      operationId: addOrganizationUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationUserRequest"
+      responses:
+        "200":
+          description: User added to organization successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+    delete:
+      summary: Remove user from organization
+      description: |
+        Used by client libraries to remove a user from an organization.
+        Both organization and user are identified by their external_id.
+        The project is taken from the projectID path parameter.
+      operationId: removeOrganizationUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RemoveOrganizationUserRequest"
+      responses:
+        "204":
+          description: User removed from organization successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/scheduled:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert user scheduled
+      description: |
+        Used by client libraries to create or update a scheduled resource for a user.
+        The user is identified by external_id or anonymous_id.
+        This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: upsertUserScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpsertUserScheduledRequest"
+      responses:
+        "202":
+          description: Scheduled resource accepted for asynchronous processing
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledAccepted"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete user scheduled
+      description: |
+        Used by client libraries to delete all scheduled instances for a user with a given scheduled resource name.
+        The user is identified by external_id or anonymous_id.
+        This cancels any pending journey entrance states that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: deleteUserScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteUserScheduledRequest"
+      responses:
+        "200":
+          description: User scheduled deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/scheduled:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert organization scheduled
+      description: |
+        Used by client libraries to create or update a scheduled resource for an organization.
+        The organization is identified by external_id.
+        This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: upsertOrganizationScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpsertOrganizationScheduledRequest"
+      responses:
+        "202":
+          description: Scheduled resource accepted for asynchronous processing
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledAccepted"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete organization scheduled
+      description: |
+        Used by client libraries to delete all scheduled instances for an organization with a given scheduled resource name.
+        The organization is identified by external_id.
+        This cancels any pending journey entrance states that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: deleteOrganizationScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteOrganizationScheduledRequest"
+      responses:
+        "200":
+          description: Organization scheduled deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/events:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Post organization events
+      description: |
+        Used by client libraries to trigger events on an organization.
+        The organization is identified by external_id.
+        Events are processed asynchronously and can trigger journeys for all users in the organization.
+        The project is taken from the projectID path parameter.
+      operationId: postOrganizationEventsClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostOrganizationEventsRequest"
+      responses:
+        "202":
+          description: Events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Create organization inbox messages
+      description: Creates one or more inbox messages for organizations identified by external identifiers. Messages are processed asynchronously.
+      operationId: postOrganizationInboxMessages
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostOrganizationInboxMessagesRequest"
+      responses:
+        "202":
+          description: Inbox messages accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+    get:
+      summary: Query organization inbox messages
+      description: Returns visible, non-expired inbox messages for an organization identified by source and external_id.
+      operationId: getOrganizationInbox
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: status
+          in: query
+          schema:
+            type: string
+            enum: [unread, read, archived]
+        - name: tags
+          in: query
+          schema:
+            type: string
+          description: Comma-separated tag filter. All listed tags must be present.
+        - name: message_source
+          in: query
+          schema:
+            type: string
+        - name: priority
+          in: query
+          schema:
+            type: integer
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+        - $ref: "#/components/parameters/Limit"
+        - $ref: "#/components/parameters/Offset"
+      responses:
+        "200":
+          description: Organization inbox messages retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxMessageList"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox/count:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    get:
+      summary: Count organization inbox messages
+      description: Returns unread and total visible inbox message counts for an organization.
+      operationId: getOrganizationInboxCount
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+      responses:
+        "200":
+          description: Organization inbox count retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxCount"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox/read:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark organization inbox messages read
+      description: Marks one or more organization inbox messages as read. Processed asynchronously.
+      operationId: postOrganizationInboxRead
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox read events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox/archived:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark organization inbox messages archived
+      description: Marks one or more organization inbox messages as archived. Processed asynchronously.
+      operationId: postOrganizationInboxArchived
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox archived events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /unsubscribe/email:
+    get:
+      summary: Email unsubscribe page
+      description: |
+        Public endpoint for email unsubscribe links. Extracts user and campaign information
+        from the encoded URL and displays an unsubscribe confirmation page.
+      operationId: emailUnsubscribe
+      tags:
+        - Subscriptions
+      parameters:
+        - name: link
+          in: query
+          required: true
+          schema:
+            type: string
+          description: Encoded unsubscribe link with user and campaign data
+      responses:
+        "200":
+          description: Unsubscribe confirmation page
+          content:
+            text/html:
+              schema:
+                type: string
+
+  /preferences/{projectID}/{userID}:
+    get:
+      summary: Subscription preferences page
+      description: |
+        Public endpoint for users to view and manage their subscription preferences.
+        Shows all public subscriptions with current user state.
+      operationId: getPreferencesPage
+      tags:
+        - Subscriptions
+      parameters:
+        - name: projectID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The project ID
+        - name: userID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The user ID
+      responses:
+        "200":
+          description: Subscription preferences page
+          content:
+            text/html:
+              schema:
+                type: string
+
+    post:
+      summary: Update subscription preferences
+      description: |
+        Handles form submission to update user subscription preferences.
+        Redirects back to preferences page with success indicator.
+      operationId: updatePreferences
+      tags:
+        - Subscriptions
+      parameters:
+        - name: projectID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The project ID
+        - name: userID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The user ID
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                subscriptionIds:
+                  type: array
+                  items:
+                    type: string
+                    format: uuid
+                  description: Array of subscription IDs to keep subscribed
+      responses:
+        "302":
+          description: Redirect to preferences page with success indicator
+        "200":
+          description: Success response (for htmx partial updates)
+          content:
+            text/html:
+              schema:
+                type: string
+
+  /api/client/projects/{projectID}/users/devices:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Register device
+      description: Register or update a device's push subscription. The project is taken from the projectID path parameter.
+      operationId: registerDevice
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeviceRegistration"
+      responses:
+        "201":
+          description: Device registered successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/push/vapid:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    get:
+      summary: Get VAPID public key
+      description: Retrieves the VAPID public key for push notifications
+      operationId: getVapidPublicKey
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      responses:
+        "200":
+          description: VAPID public key retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/VapidPublicKey"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/auth-methods/{authMethodID}/sessions:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mint a session token
+      description: |
+        Mints a short-lived session token for an end user, to be used from the
+        client. Called server-side with an API key; the session's permissions are
+        defined by the session auth method (policy) named in the path.
+      operationId: createSession
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: authMethodID
+          in: path
+          required: true
+          description: The session auth method (policy) that defines what the session may do.
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateSession"
+      responses:
+        "201":
+          description: Session token minted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SessionToken"
+        default:
+          $ref: "#/components/responses/Error"
+
+components:
+  parameters:
+    ProjectID:
+      name: projectID
+      in: path
+      required: true
+      schema:
+        type: string
+        format: uuid
+      description: The project the request acts on. Must match the project the presented credential is authorized for.
+
+    Limit:
+      name: limit
+      in: query
+      required: false
+      schema:
+        type: integer
+        minimum: 1
+        maximum: 100
+        default: 20
+        x-go-type: PaginationLimit
+      description: Maximum number of items to return
+
+    Offset:
+      name: offset
+      in: query
+      required: false
+      schema:
+        type: integer
+        minimum: 0
+        default: 0
+        x-go-type: PaginationOffset
+      description: Number of items to skip
+
+  responses:
+    Error:
+      description: Error response
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Problem"
+
+  schemas:
+    CreateSession:
+      type: object
+      description: Request to mint a session token for an end user.
+      required:
+        - user_id
+      properties:
+        user_id:
+          type: string
+          description: The end user's external identifier (the session subject).
+          example: "user_12345"
+
+    SessionToken:
+      type: object
+      required:
+        - token
+        - expires_at
+      properties:
+        token:
+          type: string
+          description: The signed session token (a bearer token for the Client API).
+        expires_at:
+          type: string
+          format: date-time
+
+    Channel:
+      type: string
+      enum: [email, sms, push, inbox]
+
+    Problem:
+      type: object
+      required:
+        - title
+        - detail
+      properties:
+        title:
+          type: string
+          description: |
+            A short summary of the problem type. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+          example: some title for the error situation
+        detail:
+          type: string
+          description: |
+            A human readable explanation specific to this occurrence of the problem that is helpful to locate the problem and give advice on how to proceed. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+          example: some description for the error situation
+
+    ExternalID:
+      type: object
+      description: An external identifier with source and optional metadata
+      required:
+        - external_id
+      properties:
+        source:
+          type: string
+          default: "default"
+          example: "default"
+          description: Source of the identifier (e.g. "default", "anonymous", or a custom source). Defaults to "default" if not provided.
+        external_id:
+          type: string
+          minLength: 1
+          example: "user_12345"
+          description: The external identifier value
+        metadata:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          description: Optional metadata associated with this identifier
+
+    ExternalIDResponse:
+      type: object
+      description: An external identifier as returned in responses, including database ID and timestamps
+      required:
+        - id
+        - source
+        - external_id
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+        source:
+          type: string
+          example: "default"
+        external_id:
+          type: string
+          example: "user_12345"
+        metadata:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+        created_at:
+          type: string
+          format: date-time
+          example: "2025-11-19T14:18:42.960Z"
+        updated_at:
+          type: string
+          format: date-time
+          example: "2025-11-23T17:20:00.021Z"
+
+    User:
+      type: object
+      required:
+        - id
+        - project_id
+        - identifier
+        - data
+        - has_push_device
+        - version
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
+        project_id:
+          type: string
+          format: uuid
+          example: "4c9d3163-7b64-4f9e-9068-d2e4b96be56b"
+        identifier:
+          type: array
+          items:
+            $ref: "#/components/schemas/ExternalIDResponse"
+          description: External identifiers associated with this user
+        email:
+          type: string
+          format: email
+          example: "user@example.com"
+          x-go-type: string
+        phone:
+          type: string
+          example: "+1234567890"
+          description: E.164 formatted phone number
+          x-go-type: string
+          format: phone
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: map[string]any
+          example:
+            first_name: "John"
+            last_name: "Doe"
+        timezone:
+          type: string
+          example: "America/New_York"
+        locale:
+          type: string
+          example: "en"
+        has_push_device:
+          type: boolean
+          example: false
+        version:
+          type: integer
+          example: 1
+          x-go-type: int32
+        created_at:
+          type: string
+          format: date-time
+          example: "2025-11-19T14:18:42.960Z"
+        updated_at:
+          type: string
+          format: date-time
+          example: "2025-11-23T17:20:00.021Z"
+
+    UserIdentifier:
+      type: array
+      description: One or more external identifiers to identify the user
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/ExternalID"
+
+    OrganizationIdentifier:
+      type: array
+      description: One or more external identifiers to identify the organization
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/ExternalID"
+
+    DeviceRegistration:
+      type: object
+      required:
+        - identifier
+        - device_id
+        - config
+      properties:
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        device_id:
+          type: string
+        os:
+          type: string
+          enum: [web, ios, android]
+        os_version:
+          type: string
+        model:
+          type: string
+        app_version:
+          type: string
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: json.RawMessage
+          example:
+            app_channel: "beta"
+            locale: "en-US"
+        config:
+          type: object
+          properties:
+            token:
+              type: string
+              description: Device token for FCM or APNs
+            endpoint:
+              type: string
+              description: Web Push subscription endpoint URL
+            expiration_time:
+              type: string
+              format: date-time
+            keys:
+              type: object
+              required: [p256dh, auth]
+              properties:
+                p256dh:
+                  type: string
+                auth:
+                  type: string
+
+    VapidPublicKey:
+      type: object
+      required:
+        - public_key
+      properties:
+        public_key:
+          type: string
+          description: The VAPID public key
+
+    IdentifyRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        email:
+          type: string
+          nullable: true
+          format: email
+          example: "user@example.com"
+          x-go-type: string
+        phone:
+          type: string
+          nullable: true
+          example: "+31612345678"
+          description: E.164 formatted phone number
+          x-go-type: string
+          format: phone
+        timezone:
+          type: string
+          nullable: true
+          example: "Europe/Amsterdam"
+        locale:
+          type: string
+          nullable: true
+          example: "nl-NL"
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            first_name: "John"
+            last_name: "Smith"
+            has_completed_onboarding: true
+          description: User-specific attributes
+
+    PostEventsRequest:
+      type: array
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/Event"
+
+    Event:
+      type: object
+      required:
+        - name
+        - data
+      properties:
+        name:
+          type: string
+          example: "purchase_completed"
+          description: The name of the event
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        match:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          description: >-
+            JSONB containment filter to match users by their data attributes.
+            Mutually exclusive with identifier. When set, the event is delivered
+            to every user whose data column contains the given key/value pairs.
+          example:
+            plan: "enterprise"
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: map[string]any
+          example:
+            product_id: "prod_789"
+            amount: 99.99
+          description: Event-specific data
+
+    InboxMessageCreate:
+      type: object
+      required:
+        - target
+        - channel
+        - identifier
+      properties:
+        target:
+          $ref: "#/components/schemas/UserIdentifier"
+        identifier:
+          $ref: "#/components/schemas/ExternalID"
+          description: External identifier for the message. Required for idempotency and traceability back to the origin source.
+        channel:
+          $ref: "#/components/schemas/Channel"
+        sender_identity_id:
+          type: string
+          format: uuid
+          nullable: true
+          description: Required for email and sms messages. Push uses project push provider settings.
+        campaign_id:
+          type: string
+          format: uuid
+          nullable: true
+        broadcast_id:
+          type: string
+          format: uuid
+          nullable: true
+        content:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: json.RawMessage
+          description: Channel-specific payload content.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+        tags:
+          type: array
+          items:
+            type: string
+        priority:
+          type: integer
+          minimum: 1
+          maximum: 5
+          default: 3
+          x-go-type: int16
+        source:
+          type: string
+          nullable: true
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+        expires_at:
+          type: string
+          format: date-time
+          nullable: true
+
+    OrganizationInboxMessageCreate:
+      type: object
+      required:
+        - target
+        - channel
+        - identifier
+      properties:
+        target:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        identifier:
+          $ref: "#/components/schemas/ExternalID"
+          description: External identifier for the message. Required for idempotency and traceability back to the origin source.
+        channel:
+          $ref: "#/components/schemas/Channel"
+        sender_identity_id:
+          type: string
+          format: uuid
+          nullable: true
+          description: Required for email and sms messages. Push uses project push provider settings.
+        campaign_id:
+          type: string
+          format: uuid
+          nullable: true
+        broadcast_id:
+          type: string
+          format: uuid
+          nullable: true
+        content:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: json.RawMessage
+          description: Channel-specific payload content.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+        tags:
+          type: array
+          items:
+            type: string
+        priority:
+          type: integer
+          minimum: 1
+          maximum: 5
+          default: 3
+          x-go-type: int16
+        source:
+          type: string
+          nullable: true
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+        expires_at:
+          type: string
+          format: date-time
+          nullable: true
+
+    PostUserInboxMessagesRequest:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/InboxMessageCreate"
+
+    PostOrganizationInboxMessagesRequest:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/OrganizationInboxMessageCreate"
+
+    UserInboxMessageRef:
+      type: object
+      required:
+        - target
+        - message_id
+      properties:
+        target:
+          $ref: "#/components/schemas/UserIdentifier"
+        message_id:
+          type: string
+          format: uuid
+
+    OrganizationInboxMessageRef:
+      type: object
+      required:
+        - target
+        - message_id
+      properties:
+        target:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        message_id:
+          type: string
+          format: uuid
+
+    UserInboxMessageEvents:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/UserInboxMessageRef"
+
+    OrganizationInboxMessageEvents:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/OrganizationInboxMessageRef"
+
+    InboxMessage:
+      type: object
+      required:
+        - id
+        - project_id
+        - channel
+        - content
+        - data
+        - tags
+        - priority
+        - scheduled_at
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        project_id:
+          type: string
+          format: uuid
+        user_id:
+          type: string
+          format: uuid
+        organization_id:
+          type: string
+          format: uuid
+        external_id:
+          type: string
+          nullable: true
+          description: External identifier for the message, if one was provided at creation time.
+        channel:
+          $ref: "#/components/schemas/Channel"
+        sender_identity_id:
+          type: string
+          format: uuid
+          nullable: true
+        campaign_id:
+          type: string
+          format: uuid
+          nullable: true
+        broadcast_id:
+          type: string
+          format: uuid
+          nullable: true
+        content:
+          type: object
+          additionalProperties: true
+          x-go-type: json.RawMessage
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: json.RawMessage
+        tags:
+          type: array
+          items:
+            type: string
+        priority:
+          type: integer
+          minimum: 1
+          maximum: 5
+          x-go-type: int16
+        source:
+          type: string
+          nullable: true
+        scheduled_at:
+          type: string
+          format: date-time
+        expires_at:
+          type: string
+          format: date-time
+          nullable: true
+        read_at:
+          type: string
+          format: date-time
+          nullable: true
+        archived_at:
+          type: string
+          format: date-time
+          nullable: true
+        sent_at:
+          type: string
+          format: date-time
+          nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+
+    InboxMessageList:
+      type: object
+      required:
+        - results
+        - total
+        - limit
+        - offset
+      properties:
+        results:
+          type: array
+          items:
+            $ref: "#/components/schemas/InboxMessage"
+        total:
+          type: integer
+        limit:
+          type: integer
+        offset:
+          type: integer
+
+    InboxCount:
+      type: object
+      required:
+        - unread
+        - total
+      properties:
+        unread:
+          type: integer
+        total:
+          type: integer
+
+    Organization:
+      type: object
+      required:
+        - id
+        - project_id
+        - identifier
+        - data
+        - version
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
+        project_id:
+          type: string
+          format: uuid
+          example: "4c9d3163-7b64-4f9e-9068-d2e4b96be56b"
+        identifier:
+          type: array
+          items:
+            $ref: "#/components/schemas/ExternalIDResponse"
+          description: External identifiers associated with this organization
+        name:
+          type: string
+          example: "Acme Corp"
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: map[string]any
+          example:
+            industry: "technology"
+            size: "enterprise"
+        version:
+          type: integer
+          example: 1
+          x-go-type: int32
+        created_at:
+          type: string
+          format: date-time
+          example: "2025-11-19T14:18:42.960Z"
+        updated_at:
+          type: string
+          format: date-time
+          example: "2025-11-23T17:20:00.021Z"
+
+    OrganizationRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        name:
+          type: string
+          nullable: true
+          example: "Acme Corp"
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            industry: "technology"
+            size: "enterprise"
+
+    OrganizationUserRequest:
+      type: object
+      required:
+        - organization
+        - user
+      properties:
+        organization:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/OrganizationIdentifier"
+        user:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/UserIdentifier"
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            role: "admin"
+            department: "engineering"
+          description: Organization-specific data for this user
+
+    DeleteUserRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+
+    DeleteOrganizationRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+
+    RemoveOrganizationUserRequest:
+      type: object
+      required:
+        - organization
+        - user
+      properties:
+        organization:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/OrganizationIdentifier"
+        user:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/UserIdentifier"
+
+    PostOrganizationEventsRequest:
+      type: array
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/OrganizationEvent"
+
+    OrganizationEvent:
+      type: object
+      required:
+        - name
+      properties:
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        match:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          description: >-
+            JSONB containment filter to match organizations by their data attributes.
+            Mutually exclusive with identifier. When set, the event is delivered
+            to every organization whose data column contains the given key/value pairs.
+          example:
+            plan: "enterprise"
+        name:
+          type: string
+          example: "subscription_upgraded"
+          description: The name of the event
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            plan: "enterprise"
+            seats: 100
+          description: Event-specific data
+
+    UpsertUserScheduledRequest:
+      type: object
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          example: "renewal_date"
+          description: The name of the scheduled resource
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-12-25T10:00:00Z"
+          description: The time at which the scheduled resource is set to trigger. Required for single schedules.
+        start_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-01-01T00:00:00Z"
+          description: Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+        interval:
+          type: string
+          nullable: true
+          example: "24h"
+          description: Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            plan: "pro"
+            amount: 29.99
+          description: Scheduled resource data
+
+    UpsertOrganizationScheduledRequest:
+      type: object
+      required:
+        - name
+        - identifier
+      properties:
+        name:
+          type: string
+          example: "contract_renewal"
+          description: The name of the scheduled resource
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-12-25T10:00:00Z"
+          description: The time at which the scheduled resource is set to trigger. Required for single schedules.
+        start_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-01-01T00:00:00Z"
+          description: Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+        interval:
+          type: string
+          nullable: true
+          example: "24h"
+          description: Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            contract_type: "enterprise"
+            seats: 100
+          description: Scheduled resource data
+
+    DeleteUserScheduledRequest:
+      type: object
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          example: "renewal_date"
+          description: The name of the scheduled resource to delete
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+
+    ScheduledAccepted:
+      type: object
+      required:
+        - id
+        - name
+        - scheduled_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+          description: The unique identifier for the scheduled instance
+        name:
+          type: string
+          example: "trial_end"
+          description: The name of the scheduled resource
+        scheduled_at:
+          type: string
+          format: date-time
+          example: "2025-01-15T09:00:00Z"
+          description: The time at which the scheduled resource is set to trigger
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: "map[string]any"
+          description: Scheduled resource data
+
+    DeleteOrganizationScheduledRequest:
+      type: object
+      required:
+        - name
+        - identifier
+      properties:
+        name:
+          type: string
+          example: "contract_renewal"
+          description: The name of the scheduled resource to delete
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+
+  securitySchemes:
+    HttpBearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: JWT token for API authentication
diff --git a/src/core/client.ts b/src/core/client.ts
index a4f0303..4e4a07d 100644
--- a/src/core/client.ts
+++ b/src/core/client.ts
@@ -1,20 +1,24 @@
 import { ClientProps } from '../types'
-import { HttpHandler } from './http'
+import { Transport } from './transport'
 import { createClientNamespace, ClientNamespace } from './factory'
 
 export class Client {
     readonly user: ClientNamespace['user']
     readonly organization: ClientNamespace['organization']
-    readonly #http: HttpHandler
+    readonly push: ClientNamespace['push']
+    readonly sessions: ClientNamespace['sessions']
+    readonly #transport: Transport
 
     constructor(props: ClientProps) {
-        this.#http = new HttpHandler(props)
-        const namespace = createClientNamespace(this.#http)
+        this.#transport = new Transport(props)
+        const namespace = createClientNamespace(this.#transport)
         this.user = namespace.user
         this.organization = namespace.organization
+        this.push = namespace.push
+        this.sessions = namespace.sessions
     }
 
-    protected get httpHandler(): HttpHandler {
-        return this.#http
+    protected get transport(): Transport {
+        return this.#transport
     }
 }
diff --git a/src/core/factory.ts b/src/core/factory.ts
index 99edaab..132b359 100644
--- a/src/core/factory.ts
+++ b/src/core/factory.ts
@@ -1,19 +1,23 @@
-import { HttpHandler } from './http'
+import { Transport } from './transport'
 import { ClientProps } from '../types'
-import { UserResource, OrganizationResource } from './resources'
+import { UserResource, OrganizationResource, PushResource, SessionResource } from './resources'
 
 export interface ClientNamespace {
     user: UserResource
     organization: OrganizationResource
+    push: PushResource
+    sessions: SessionResource
 }
 
-export function createClientNamespace(http: HttpHandler): ClientNamespace {
+export function createClientNamespace(transport: Transport): ClientNamespace {
     return {
-        user: new UserResource(http),
-        organization: new OrganizationResource(http),
+        user: new UserResource(transport),
+        organization: new OrganizationResource(transport),
+        push: new PushResource(transport),
+        sessions: new SessionResource(transport),
     }
 }
 
-export function createHttpHandler(props: ClientProps): HttpHandler {
-    return new HttpHandler(props)
+export function createTransport(props: ClientProps): Transport {
+    return new Transport(props)
 }
diff --git a/src/core/http.ts b/src/core/http.ts
deleted file mode 100644
index 9685aff..0000000
--- a/src/core/http.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-import { ClientProps } from '../types'
-import { mapKeys } from '../utils'
-import { DefaultEndpoint } from './constants'
-import {
-    LunogramError,
-    NetworkError,
-    RequestError,
-    UnauthorizedError,
-    ForbiddenError,
-    NotFoundError,
-    ValidationError,
-} from './errors'
-
-type HttpMethod = 'GET' | 'POST' | 'DELETE'
-
-const statusErrorFactories: Partial<Record<number, () => LunogramError>> = {
-    400: () => new ValidationError('Invalid request'),
-    401: () => new UnauthorizedError(),
-    403: () => new ForbiddenError(),
-    404: () => new NotFoundError(),
-}
-
-export class HttpHandler {
-    readonly #apiKey: string
-    readonly #baseUrl: string
-
-    constructor(props: ClientProps) {
-        this.#apiKey = props.apiKey
-        this.#baseUrl = props.urlEndpoint ?? DefaultEndpoint
-    }
-
-    async get<T = unknown>(path: string, data?: unknown): Promise<T> {
-        return this.#request<T>('GET', path, data)
-    }
-
-    async post<T = unknown>(path: string, data?: unknown): Promise<T> {
-        return this.#request<T>('POST', path, data)
-    }
-
-    async delete<T = unknown>(path: string, data?: unknown): Promise<T> {
-        return this.#request<T>('DELETE', path, data)
-    }
-
-    async #request<T>(method: HttpMethod, path: string, data?: unknown): Promise<T> {
-        const url = `${this.#baseUrl}/client/${path}`
-
-        try {
-            const response = await fetch(url, {
-                method,
-                headers: {
-                    'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${this.#apiKey}`,
-                },
-                body: data ? JSON.stringify(mapKeys(data)) : undefined,
-            })
-
-            return this.#handleResponse<T>(response)
-        } catch (error) {
-            if (error instanceof LunogramError) {
-                throw error
-            }
-
-            const message = error instanceof Error ? error.message : 'Unknown error'
-            throw new NetworkError(`Network request failed: ${message}`, error instanceof Error ? error : undefined)
-        }
-    }
-
-    async #handleResponse<T>(response: Response): Promise<T> {
-        if (!response.ok) {
-            throw await this.#mapError(response)
-        }
-
-        const contentType = response.headers.get('content-type')
-        if (!contentType || !contentType.includes('application/json')) {
-            return undefined as T
-        }
-
-        return response.json() as Promise<T>
-    }
-
-    async #mapError(response: Response): Promise<LunogramError> {
-        const status = response.status
-
-        const createError = statusErrorFactories[status]
-        if (createError) {
-            return createError()
-        }
-
-        let detail = `Request failed with status ${status}`
-        try {
-            const body = await response.json()
-            if (body?.detail) {
-                detail = body.detail
-            }
-        } catch {
-            // no parseable body
-        }
-
-        return new RequestError(status, detail)
-    }
-}
diff --git a/src/core/resources/base.ts b/src/core/resources/base.ts
index 5f418bf..6ef20dc 100644
--- a/src/core/resources/base.ts
+++ b/src/core/resources/base.ts
@@ -1,23 +1,62 @@
-import { HttpHandler } from '../http'
+import { Transport, TypedFetchClient } from '../transport'
+import { LunogramError, NetworkError } from '../errors'
 
+/**
+ * Base class for the hand-written resource facades.
+ *
+ * Resources call the spec-generated typed client ({@link TypedFetchClient})
+ * exposed by {@link Transport}. The `{projectID}` path parameter is injected
+ * here for every call ({@link withProject}) so individual methods only name
+ * their operation and payload — never the project scoping or the path prefix,
+ * which come from the generated layer.
+ */
 export abstract class BaseResource {
-    readonly #http: HttpHandler
+    protected readonly transport: Transport
 
-    constructor(http: HttpHandler) {
-        this.#http = http
+    constructor(transport: Transport) {
+        this.transport = transport
     }
 
-    protected abstract readonly endpoint: string
-
-    protected async get<T = unknown>(data?: unknown): Promise<T> {
-        return this.#http.get<T>(this.endpoint, data)
+    protected get client(): TypedFetchClient {
+        return this.transport.client
     }
 
-    protected async post<T = unknown>(data?: unknown, pathOverride?: string): Promise<T> {
-        return this.#http.post<T>(pathOverride ?? this.endpoint, data)
+    /**
+     * Build the request `params` object with the `{projectID}` path parameter
+     * filled in, merged with any extra path params an operation needs.
+     */
+    protected withProject<P extends Record<string, unknown> = Record<string, never>>(
+        path?: P,
+    ): { path: P & { projectID: string } } {
+        return { path: { ...(path as P), projectID: this.transport.projectId } }
     }
 
-    protected async remove<T = unknown>(data?: unknown, pathOverride?: string): Promise<T> {
-        return this.#http.delete<T>(pathOverride ?? this.endpoint, data)
+    /**
+     * Run a generated-client call and normalize the outcome: translate raw
+     * fetch failures into {@link NetworkError} and HTTP failures into the
+     * Lunogram error hierarchy (via {@link Transport.unwrap}).
+     *
+     * The generated client returns wire (snake_case) response types; the public
+     * facade types are camelCase. The SDK has always returned the raw JSON body
+     * typed as its camelCase type (responses are not re-mapped at runtime), so
+     * the result data is cast to the requested `T` at this single boundary.
+     */
+    protected async call<T>(
+        op: () => Promise<{ data?: unknown; error?: unknown; response: Response }>,
+    ): Promise<T> {
+        let result
+        try {
+            result = await op()
+        } catch (error) {
+            if (error instanceof LunogramError) {
+                throw error
+            }
+            const message = error instanceof Error ? error.message : 'Unknown error'
+            throw new NetworkError(
+                `Network request failed: ${message}`,
+                error instanceof Error ? error : undefined,
+            )
+        }
+        return this.transport.unwrap<T>(result as { data?: T; error?: unknown; response: Response })
     }
 }
diff --git a/src/core/resources/inbox-query.ts b/src/core/resources/inbox-query.ts
new file mode 100644
index 0000000..e899a50
--- /dev/null
+++ b/src/core/resources/inbox-query.ts
@@ -0,0 +1,36 @@
+import { InboxQuery, InboxCountQuery } from '../../types'
+
+/**
+ * Translate the camelCase {@link InboxQuery} facade into the snake_case query
+ * object the generated client expects. Query parameters (unlike JSON bodies)
+ * are not re-mapped by the transport middleware, so the wire keys are produced
+ * here. Undefined optionals are dropped so they never reach the query string.
+ */
+export function toInboxQuery(q: InboxQuery) {
+    return prune({
+        source: q.source,
+        external_id: q.externalId,
+        channel: q.channel,
+        status: q.status,
+        tags: q.tags,
+        message_source: q.messageSource,
+        priority: q.priority,
+        limit: q.limit,
+        offset: q.offset,
+    })
+}
+
+/** Translate the camelCase {@link InboxCountQuery} facade into the wire query. */
+export function toInboxCountQuery(q: InboxCountQuery) {
+    return {
+        source: q.source,
+        external_id: q.externalId,
+        channel: q.channel,
+    }
+}
+
+function prune<T extends Record<string, unknown>>(obj: T): T {
+    return Object.fromEntries(
+        Object.entries(obj).filter(([, value]) => value !== undefined),
+    ) as T
+}
diff --git a/src/core/resources/index.ts b/src/core/resources/index.ts
index 166de2f..69a116c 100644
--- a/src/core/resources/index.ts
+++ b/src/core/resources/index.ts
@@ -1,3 +1,16 @@
 export { BaseResource } from './base'
-export { UserResource, UserScheduledResource } from './users'
-export { OrganizationResource, OrganizationScheduledResource } from './organizations'
\ No newline at end of file
+export {
+    UserResource,
+    UserScheduledResource,
+    UserEventsResource,
+    UserInboxResource,
+    UserDevicesResource,
+} from './users'
+export {
+    OrganizationResource,
+    OrganizationScheduledResource,
+    OrganizationEventsResource,
+    OrganizationInboxResource,
+} from './organizations'
+export { PushResource } from './push'
+export { SessionResource } from './sessions'
\ No newline at end of file
diff --git a/src/core/resources/organizations/events.ts b/src/core/resources/organizations/events.ts
index 8e7face..c024d29 100644
--- a/src/core/resources/organizations/events.ts
+++ b/src/core/resources/organizations/events.ts
@@ -1,14 +1,17 @@
-import { OrganizationEvent } from "../../../types"
-import { BaseResource } from "../base"
+import { OrganizationEvent } from '../../../types'
+import { BaseResource } from '../base'
 
 export class OrganizationEventsResource extends BaseResource {
-    readonly endpoint = 'organizations/events'
-
     /**
      * Posts organization events for asynchronous processing.
      * @param data - Array of organization events
      */
     async post<T = unknown>(data: OrganizationEvent[]): Promise<T> {
-        return super.post(data)
+        return this.call<T>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/events', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/organizations/inbox.ts b/src/core/resources/organizations/inbox.ts
new file mode 100644
index 0000000..36914a5
--- /dev/null
+++ b/src/core/resources/organizations/inbox.ts
@@ -0,0 +1,80 @@
+import { BaseResource } from '../base'
+import {
+    OrganizationInboxMessageCreate,
+    InboxMessageList,
+    InboxCount,
+    InboxQuery,
+    InboxCountQuery,
+    OrganizationInboxMessageRef,
+} from '../../../types'
+import { toInboxQuery, toInboxCountQuery } from '../inbox-query'
+
+/**
+ * Resource for managing an organization's inbox messages.
+ */
+export class OrganizationInboxResource extends BaseResource {
+    /**
+     * Creates one or more inbox messages for organizations. Processed asynchronously.
+     * @param messages - Inbox messages to create (max 100)
+     */
+    async create(messages: OrganizationInboxMessageCreate[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/inbox', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Returns visible, non-expired inbox messages for an organization.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to a paginated list of inbox messages
+     */
+    async query(query: InboxQuery): Promise<InboxMessageList> {
+        return this.call<InboxMessageList>(() =>
+            this.client.GET('/api/client/projects/{projectID}/organizations/inbox', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Returns unread and total visible inbox message counts for an organization.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to the inbox counts
+     */
+    async count(query: InboxCountQuery): Promise<InboxCount> {
+        return this.call<InboxCount>(() =>
+            this.client.GET('/api/client/projects/{projectID}/organizations/inbox/count', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxCountQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more organization inbox messages as read. Processed asynchronously.
+     * @param messages - References to the messages to mark read (max 100)
+     */
+    async markRead(messages: OrganizationInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/inbox/read', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more organization inbox messages as archived. Processed asynchronously.
+     * @param messages - References to the messages to mark archived (max 100)
+     */
+    async markArchived(messages: OrganizationInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/inbox/archived', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/organizations/index.ts b/src/core/resources/organizations/index.ts
index 237ff2c..50e521b 100644
--- a/src/core/resources/organizations/index.ts
+++ b/src/core/resources/organizations/index.ts
@@ -1,3 +1,4 @@
 export { OrganizationResource } from './organization'
 export { OrganizationScheduledResource } from './scheduled'
-export { OrganizationEventsResource } from './events'
\ No newline at end of file
+export { OrganizationEventsResource } from './events'
+export { OrganizationInboxResource } from './inbox'
\ No newline at end of file
diff --git a/src/core/resources/organizations/organization.ts b/src/core/resources/organizations/organization.ts
index 19b291a..328c5ff 100644
--- a/src/core/resources/organizations/organization.ts
+++ b/src/core/resources/organizations/organization.ts
@@ -4,21 +4,23 @@ import {
     OrganizationResponse,
     OrganizationUserRequest,
     RemoveOrganizationUserRequest,
-} from "../../../types"
-import { BaseResource } from "../base"
-import { HttpHandler } from "../../http"
-import { OrganizationScheduledResource } from "./scheduled"
-import { OrganizationEventsResource } from "./events"
+} from '../../../types'
+import { BaseResource } from '../base'
+import { Transport } from '../../transport'
+import { OrganizationScheduledResource } from './scheduled'
+import { OrganizationEventsResource } from './events'
+import { OrganizationInboxResource } from './inbox'
 
 export class OrganizationResource extends BaseResource {
-    readonly endpoint = 'organizations'
     readonly schedule: OrganizationScheduledResource
     readonly events: OrganizationEventsResource
+    readonly inbox: OrganizationInboxResource
 
-    constructor(http: HttpHandler) {
-        super(http)
-        this.schedule = new OrganizationScheduledResource(http)
-        this.events = new OrganizationEventsResource(http)
+    constructor(transport: Transport) {
+        super(transport)
+        this.schedule = new OrganizationScheduledResource(transport)
+        this.events = new OrganizationEventsResource(transport)
+        this.inbox = new OrganizationInboxResource(transport)
     }
 
     /**
@@ -27,7 +29,12 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving to the created/updated organization
      */
     async upsert(data: OrganizationRequest): Promise<OrganizationResponse> {
-        return this.post(data)
+        return this.call<OrganizationResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -36,7 +43,12 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving when organization is deleted
      */
     async delete(data: DeleteOrganizationRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/organizations', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -45,7 +57,12 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving when user is added
      */
     async addUser(data: OrganizationUserRequest): Promise<void> {
-        return this.post(data, 'organizations/users')
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -54,6 +71,11 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving when user is removed
      */
     async removeUser(data: RemoveOrganizationUserRequest): Promise<void> {
-        return this.remove(data, 'organizations/users')
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/organizations/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/organizations/scheduled.ts b/src/core/resources/organizations/scheduled.ts
index af2f77d..4addad6 100644
--- a/src/core/resources/organizations/scheduled.ts
+++ b/src/core/resources/organizations/scheduled.ts
@@ -9,15 +9,18 @@ import {
  * Resource for managing scheduled organization resources.
  */
 export class OrganizationScheduledResource extends BaseResource {
-    readonly endpoint = 'organizations/scheduled'
-
     /**
      * Creates or updates a scheduled resource for an organization.
      * @param data - Scheduled resource data including name, identifier, scheduledAt, interval, etc.
      * @returns Promise resolving to the accepted scheduled resource
      */
     async upsert(data: UpsertOrganizationScheduledRequest): Promise<ScheduledAcceptedResponse> {
-        return this.post(data)
+        return this.call<ScheduledAcceptedResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -26,6 +29,11 @@ export class OrganizationScheduledResource extends BaseResource {
      * @returns Promise resolving when scheduled resource is deleted
      */
     async delete(data: DeleteOrganizationScheduledRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/organizations/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/push.ts b/src/core/resources/push.ts
new file mode 100644
index 0000000..e954ebe
--- /dev/null
+++ b/src/core/resources/push.ts
@@ -0,0 +1,19 @@
+import { BaseResource } from './base'
+import { VapidPublicKey } from '../../types'
+
+/**
+ * Project-level resource for push notification configuration.
+ */
+export class PushResource extends BaseResource {
+    /**
+     * Retrieves the project's VAPID public key for Web Push.
+     * @returns Promise resolving to the VAPID public key
+     */
+    async getVapidPublicKey(): Promise<VapidPublicKey> {
+        return this.call<VapidPublicKey>(() =>
+            this.client.GET('/api/client/projects/{projectID}/push/vapid', {
+                params: this.withProject(),
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/sessions.ts b/src/core/resources/sessions.ts
new file mode 100644
index 0000000..09be360
--- /dev/null
+++ b/src/core/resources/sessions.ts
@@ -0,0 +1,26 @@
+import { BaseResource } from './base'
+import { CreateSessionRequest, SessionToken } from '../../types'
+
+/**
+ * Project-level resource for minting end-user session tokens.
+ *
+ * Called server-side with an API key; the returned token is a short-lived
+ * bearer token for the Client API whose permissions are defined by the session
+ * auth method (policy) named by `authMethodId`.
+ */
+export class SessionResource extends BaseResource {
+    /**
+     * Mints a session token for an end user.
+     * @param authMethodId - The session auth method (policy) the session uses
+     * @param data - Request identifying the session subject (the end user)
+     * @returns Promise resolving to the minted session token
+     */
+    async create(authMethodId: string, data: CreateSessionRequest): Promise<SessionToken> {
+        return this.call<SessionToken>(() =>
+            this.client.POST('/api/client/projects/{projectID}/auth-methods/{authMethodID}/sessions', {
+                params: this.withProject({ authMethodID: authMethodId }),
+                body: data as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/users/devices.ts b/src/core/resources/users/devices.ts
new file mode 100644
index 0000000..92ebac0
--- /dev/null
+++ b/src/core/resources/users/devices.ts
@@ -0,0 +1,20 @@
+import { BaseResource } from '../base'
+import { DeviceRegistration } from '../../../types'
+
+/**
+ * Resource for registering a user's push-capable devices.
+ */
+export class UserDevicesResource extends BaseResource {
+    /**
+     * Registers or updates a device's push subscription for a user.
+     * @param data - Device registration including identifier, deviceId and config
+     */
+    async register(data: DeviceRegistration): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/devices', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/users/events.ts b/src/core/resources/users/events.ts
index 39c3c48..b17640f 100644
--- a/src/core/resources/users/events.ts
+++ b/src/core/resources/users/events.ts
@@ -1,14 +1,17 @@
-import { UserEvent } from "../../../types"
-import { BaseResource } from "../base"
+import { UserEvent } from '../../../types'
+import { BaseResource } from '../base'
 
 export class UserEventsResource extends BaseResource {
-    readonly endpoint = 'users/events'
-
     /**
      * Posts user events for asynchronous processing.
      * @param data - Array of user events
      */
     async post<T = unknown>(data: UserEvent[]): Promise<T> {
-        return super.post(data)
+        return this.call<T>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/events', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/users/inbox.ts b/src/core/resources/users/inbox.ts
new file mode 100644
index 0000000..9052da6
--- /dev/null
+++ b/src/core/resources/users/inbox.ts
@@ -0,0 +1,80 @@
+import { BaseResource } from '../base'
+import {
+    InboxMessageCreate,
+    InboxMessageList,
+    InboxCount,
+    InboxQuery,
+    InboxCountQuery,
+    UserInboxMessageRef,
+} from '../../../types'
+import { toInboxQuery, toInboxCountQuery } from '../inbox-query'
+
+/**
+ * Resource for managing a user's inbox messages.
+ */
+export class UserInboxResource extends BaseResource {
+    /**
+     * Creates one or more inbox messages for users. Processed asynchronously.
+     * @param messages - Inbox messages to create (max 100)
+     */
+    async create(messages: InboxMessageCreate[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/inbox', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Returns visible, non-expired inbox messages for a user.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to a paginated list of inbox messages
+     */
+    async query(query: InboxQuery): Promise<InboxMessageList> {
+        return this.call<InboxMessageList>(() =>
+            this.client.GET('/api/client/projects/{projectID}/users/inbox', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Returns unread and total visible inbox message counts for a user.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to the inbox counts
+     */
+    async count(query: InboxCountQuery): Promise<InboxCount> {
+        return this.call<InboxCount>(() =>
+            this.client.GET('/api/client/projects/{projectID}/users/inbox/count', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxCountQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more user inbox messages as read. Processed asynchronously.
+     * @param messages - References to the messages to mark read (max 100)
+     */
+    async markRead(messages: UserInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/inbox/read', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more user inbox messages as archived. Processed asynchronously.
+     * @param messages - References to the messages to mark archived (max 100)
+     */
+    async markArchived(messages: UserInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/inbox/archived', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/users/index.ts b/src/core/resources/users/index.ts
index aea3ac6..6d72219 100644
--- a/src/core/resources/users/index.ts
+++ b/src/core/resources/users/index.ts
@@ -1,3 +1,5 @@
 export { UserResource } from './user'
 export { UserScheduledResource } from './scheduled'
-export { UserEventsResource } from './events'
\ No newline at end of file
+export { UserEventsResource } from './events'
+export { UserInboxResource } from './inbox'
+export { UserDevicesResource } from './devices'
\ No newline at end of file
diff --git a/src/core/resources/users/scheduled.ts b/src/core/resources/users/scheduled.ts
index bc033af..93a721f 100644
--- a/src/core/resources/users/scheduled.ts
+++ b/src/core/resources/users/scheduled.ts
@@ -9,15 +9,18 @@ import {
  * Resource for managing scheduled user resources.
  */
 export class UserScheduledResource extends BaseResource {
-    readonly endpoint = 'users/scheduled'
-
     /**
      * Creates or updates a scheduled resource for a user.
      * @param data - Scheduled resource data including name, identifier, scheduledAt, interval, etc.
      * @returns Promise resolving to the accepted scheduled resource
      */
     async upsert(data: UpsertUserScheduledRequest): Promise<ScheduledAcceptedResponse> {
-        return this.post(data)
+        return this.call<ScheduledAcceptedResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -26,6 +29,11 @@ export class UserScheduledResource extends BaseResource {
      * @returns Promise resolving when scheduled resource is deleted
      */
     async delete(data: DeleteUserScheduledRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/users/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/users/user.ts b/src/core/resources/users/user.ts
index 5af36fb..b1be057 100644
--- a/src/core/resources/users/user.ts
+++ b/src/core/resources/users/user.ts
@@ -1,5 +1,5 @@
-import { BaseResource } from './../base'
-import { HttpHandler } from '../../http'
+import { BaseResource } from '../base'
+import { Transport } from '../../transport'
 import {
     UpsertUserRequest,
     DeleteUserRequest,
@@ -7,16 +7,21 @@ import {
 } from '../../../types'
 import { UserScheduledResource } from './scheduled'
 import { UserEventsResource } from './events'
+import { UserInboxResource } from './inbox'
+import { UserDevicesResource } from './devices'
 
 export class UserResource extends BaseResource {
-    readonly endpoint = 'users'
     readonly schedule: UserScheduledResource
     readonly events: UserEventsResource
+    readonly inbox: UserInboxResource
+    readonly devices: UserDevicesResource
 
-    constructor(http: HttpHandler) {
-        super(http)
-        this.schedule = new UserScheduledResource(http)
-        this.events = new UserEventsResource(http)
+    constructor(transport: Transport) {
+        super(transport)
+        this.schedule = new UserScheduledResource(transport)
+        this.events = new UserEventsResource(transport)
+        this.inbox = new UserInboxResource(transport)
+        this.devices = new UserDevicesResource(transport)
     }
 
     /**
@@ -25,7 +30,12 @@ export class UserResource extends BaseResource {
      * @returns Promise resolving to the created/updated user
      */
     async upsert(data: UpsertUserRequest): Promise<UserResponse> {
-        return this.post(data)
+        return this.call<UserResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -34,6 +44,11 @@ export class UserResource extends BaseResource {
      * @returns Promise resolving when user is deleted
      */
     async delete(data: DeleteUserRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/transport.ts b/src/core/transport.ts
new file mode 100644
index 0000000..b1f45ee
--- /dev/null
+++ b/src/core/transport.ts
@@ -0,0 +1,136 @@
+import createClient, { type Client as FetchClient, type Middleware } from 'openapi-fetch'
+import type { paths } from '../gen/schema'
+import { ClientProps } from '../types'
+import { mapKeys, isUuid } from '../utils'
+import { DefaultEndpoint } from './constants'
+import {
+    LunogramError,
+    RequestError,
+    UnauthorizedError,
+    ForbiddenError,
+    NotFoundError,
+    ValidationError,
+} from './errors'
+
+/**
+ * Typed openapi-fetch client generated against the vendored OpenAPI spec
+ * (`src/gen/schema.ts`). Every operation, path and payload shape is derived
+ * from the spec; this module only adds the cross-cutting concerns the spec
+ * cannot express: auth, the project scoping, snake_case mapping and the
+ * Lunogram error hierarchy.
+ */
+export type TypedFetchClient = FetchClient<paths>
+
+const statusErrorFactories: Partial<Record<number, () => LunogramError>> = {
+    400: () => new ValidationError('Invalid request'),
+    401: () => new UnauthorizedError(),
+    403: () => new ForbiddenError(),
+    404: () => new NotFoundError(),
+}
+
+/**
+ * Derive the openapi-fetch base URL from the configured endpoint.
+ *
+ * The spec carries the `/api` prefix on every path
+ * (`/api/client/projects/{projectID}/...`), so the base URL must be the bare
+ * origin. The public `urlEndpoint` has historically included a trailing
+ * `/api`; we strip exactly one so both `https://host` and `https://host/api`
+ * resolve to the same, correct URL.
+ */
+function toBaseUrl(endpoint: string): string {
+    const trimmed = endpoint.replace(/\/+$/, '')
+    return trimmed.replace(/\/api$/, '')
+}
+
+/**
+ * Thin transport over openapi-fetch. The `projectID` path parameter is bound
+ * once here (via the public {@link Transport.projectId} getter that resources
+ * read) and the auth header + snake_case body mapping are applied centrally in
+ * middleware, so resource modules never repeat any of it.
+ */
+export class Transport {
+    readonly #client: TypedFetchClient
+    readonly #projectId: string
+
+    constructor(props: ClientProps) {
+        const projectId = props.projectId?.trim()
+        if (!projectId) {
+            throw new ValidationError('A non-empty `projectId` is required to create a Lunogram client')
+        }
+        if (!isUuid(projectId)) {
+            throw new ValidationError('`projectId` must be a valid UUID')
+        }
+
+        this.#projectId = projectId
+
+        const baseUrl = toBaseUrl(props.urlEndpoint ?? DefaultEndpoint)
+        this.#client = createClient<paths>({ baseUrl })
+
+        const apiKey = props.apiKey
+
+        // Auth + body mapping: applied to every request, once.
+        const middleware: Middleware = {
+            async onRequest({ request }) {
+                request.headers.set('Authorization', `Bearer ${apiKey}`)
+
+                // The public API speaks camelCase; the wire format is
+                // snake_case. Re-encode the JSON body centrally so resource
+                // modules can pass through their typed payloads untouched.
+                const contentType = request.headers.get('content-type')
+                if (contentType?.includes('application/json')) {
+                    const raw = await request.clone().text()
+                    if (raw) {
+                        const mapped = mapKeys(JSON.parse(raw))
+                        return new Request(request, { body: JSON.stringify(mapped) })
+                    }
+                }
+
+                return request
+            },
+        }
+        this.#client.use(middleware)
+    }
+
+    /**
+     * The validated project UUID. Resource modules pass this as the
+     * `{projectID}` path parameter so the spec-generated paths resolve under
+     * `/api/client/projects/{projectId}/...`.
+     */
+    get projectId(): string {
+        return this.#projectId
+    }
+
+    get client(): TypedFetchClient {
+        return this.#client
+    }
+
+    /**
+     * Map an openapi-fetch result onto the Lunogram return contract: throw the
+     * appropriate {@link LunogramError} on failure, otherwise return the parsed
+     * body (or `undefined` for empty/no-content responses).
+     */
+    unwrap<T>(result: { data?: T; error?: unknown; response: Response }): T {
+        const { data, error, response } = result
+        if (response.ok) {
+            return data as T
+        }
+        throw this.mapError(response, error)
+    }
+
+    private mapError(response: Response, body: unknown): LunogramError {
+        const status = response.status
+
+        const createError = statusErrorFactories[status]
+        if (createError) {
+            return createError()
+        }
+
+        let detail = `Request failed with status ${status}`
+        const problem = body as { detail?: string } | undefined
+        if (problem?.detail) {
+            detail = problem.detail
+        }
+
+        return new RequestError(status, detail)
+    }
+}
diff --git a/src/gen/schema.ts b/src/gen/schema.ts
new file mode 100644
index 0000000..8dc39b9
--- /dev/null
+++ b/src/gen/schema.ts
@@ -0,0 +1,1892 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/api/client/projects/{projectID}/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert user
+         * @description Used by client libraries to create or update a user profile. The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertUserClient"];
+        /**
+         * Delete user
+         * @description Used by client libraries to delete a user by external_id or anonymous_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteUserClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Post user events
+         * @description Used by client libraries to trigger events for a user that can be used to execute a step in a journey or update a virtual list.
+         *     Multiple events can be sent in a single request and are processed asynchronously.
+         *     Each event is handled independently: if one event fails to be accepted or processed, other events in the same request may still be published successfully.
+         *     Clients requiring deterministic retry or recovery behavior must submit events individually.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["postUserEvents"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Query user inbox messages
+         * @description Returns visible, non-expired inbox messages for a user identified by source and external_id.
+         */
+        get: operations["getUserInbox"];
+        put?: never;
+        /**
+         * Create user inbox messages
+         * @description Creates one or more inbox messages for users identified by external identifiers. Messages are processed asynchronously.
+         */
+        post: operations["postUserInboxMessages"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox/count": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Count user inbox messages
+         * @description Returns unread and total visible inbox message counts for a user.
+         */
+        get: operations["getUserInboxCount"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox/read": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark user inbox messages read
+         * @description Marks one or more user inbox messages as read. Processed asynchronously.
+         */
+        post: operations["postUserInboxRead"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox/archived": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark user inbox messages archived
+         * @description Marks one or more user inbox messages as archived. Processed asynchronously.
+         */
+        post: operations["postUserInboxArchived"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert organization
+         * @description Used by client libraries to create or update an organization by external_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertOrganizationClient"];
+        /**
+         * Delete organization
+         * @description Used by client libraries to delete an organization by external_id.
+         *     This will also remove all organization memberships.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteOrganizationClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add user to organization
+         * @description Used by client libraries to add a user to an organization with optional org-specific data.
+         *     Both organization and user are identified by their external_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["addOrganizationUserClient"];
+        /**
+         * Remove user from organization
+         * @description Used by client libraries to remove a user from an organization.
+         *     Both organization and user are identified by their external_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["removeOrganizationUserClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/scheduled": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert user scheduled
+         * @description Used by client libraries to create or update a scheduled resource for a user.
+         *     The user is identified by external_id or anonymous_id.
+         *     This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertUserScheduledClient"];
+        /**
+         * Delete user scheduled
+         * @description Used by client libraries to delete all scheduled instances for a user with a given scheduled resource name.
+         *     The user is identified by external_id or anonymous_id.
+         *     This cancels any pending journey entrance states that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteUserScheduledClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/scheduled": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert organization scheduled
+         * @description Used by client libraries to create or update a scheduled resource for an organization.
+         *     The organization is identified by external_id.
+         *     This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertOrganizationScheduledClient"];
+        /**
+         * Delete organization scheduled
+         * @description Used by client libraries to delete all scheduled instances for an organization with a given scheduled resource name.
+         *     The organization is identified by external_id.
+         *     This cancels any pending journey entrance states that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteOrganizationScheduledClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Post organization events
+         * @description Used by client libraries to trigger events on an organization.
+         *     The organization is identified by external_id.
+         *     Events are processed asynchronously and can trigger journeys for all users in the organization.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["postOrganizationEventsClient"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Query organization inbox messages
+         * @description Returns visible, non-expired inbox messages for an organization identified by source and external_id.
+         */
+        get: operations["getOrganizationInbox"];
+        put?: never;
+        /**
+         * Create organization inbox messages
+         * @description Creates one or more inbox messages for organizations identified by external identifiers. Messages are processed asynchronously.
+         */
+        post: operations["postOrganizationInboxMessages"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox/count": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Count organization inbox messages
+         * @description Returns unread and total visible inbox message counts for an organization.
+         */
+        get: operations["getOrganizationInboxCount"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox/read": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark organization inbox messages read
+         * @description Marks one or more organization inbox messages as read. Processed asynchronously.
+         */
+        post: operations["postOrganizationInboxRead"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox/archived": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark organization inbox messages archived
+         * @description Marks one or more organization inbox messages as archived. Processed asynchronously.
+         */
+        post: operations["postOrganizationInboxArchived"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/unsubscribe/email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Email unsubscribe page
+         * @description Public endpoint for email unsubscribe links. Extracts user and campaign information
+         *     from the encoded URL and displays an unsubscribe confirmation page.
+         */
+        get: operations["emailUnsubscribe"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/preferences/{projectID}/{userID}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Subscription preferences page
+         * @description Public endpoint for users to view and manage their subscription preferences.
+         *     Shows all public subscriptions with current user state.
+         */
+        get: operations["getPreferencesPage"];
+        put?: never;
+        /**
+         * Update subscription preferences
+         * @description Handles form submission to update user subscription preferences.
+         *     Redirects back to preferences page with success indicator.
+         */
+        post: operations["updatePreferences"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/devices": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Register device
+         * @description Register or update a device's push subscription. The project is taken from the projectID path parameter.
+         */
+        post: operations["registerDevice"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/push/vapid": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get VAPID public key
+         * @description Retrieves the VAPID public key for push notifications
+         */
+        get: operations["getVapidPublicKey"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/auth-methods/{authMethodID}/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a session token
+         * @description Mints a short-lived session token for an end user, to be used from the
+         *     client. Called server-side with an API key; the session's permissions are
+         *     defined by the session auth method (policy) named in the path.
+         */
+        post: operations["createSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /** @description Request to mint a session token for an end user. */
+        CreateSession: {
+            /**
+             * @description The end user's external identifier (the session subject).
+             * @example user_12345
+             */
+            user_id: string;
+        };
+        SessionToken: {
+            /** @description The signed session token (a bearer token for the Client API). */
+            token: string;
+            /** Format: date-time */
+            expires_at: string;
+        };
+        /** @enum {string} */
+        Channel: "email" | "sms" | "push" | "inbox";
+        Problem: {
+            /**
+             * @description A short summary of the problem type. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+             * @example some title for the error situation
+             */
+            title: string;
+            /**
+             * @description A human readable explanation specific to this occurrence of the problem that is helpful to locate the problem and give advice on how to proceed. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+             * @example some description for the error situation
+             */
+            detail: string;
+        };
+        /** @description An external identifier with source and optional metadata */
+        ExternalID: {
+            /**
+             * @description Source of the identifier (e.g. "default", "anonymous", or a custom source). Defaults to "default" if not provided.
+             * @default default
+             * @example default
+             */
+            source: string;
+            /**
+             * @description The external identifier value
+             * @example user_12345
+             */
+            external_id: string;
+            /** @description Optional metadata associated with this identifier */
+            metadata?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        /** @description An external identifier as returned in responses, including database ID and timestamps */
+        ExternalIDResponse: {
+            /**
+             * Format: uuid
+             * @example a1b2c3d4-e5f6-7890-abcd-ef1234567890
+             */
+            id: string;
+            /** @example default */
+            source: string;
+            /** @example user_12345 */
+            external_id: string;
+            metadata?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * Format: date-time
+             * @example 2025-11-19T14:18:42.960Z
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @example 2025-11-23T17:20:00.021Z
+             */
+            updated_at: string;
+        };
+        User: {
+            /**
+             * Format: uuid
+             * @example 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @example 4c9d3163-7b64-4f9e-9068-d2e4b96be56b
+             */
+            project_id: string;
+            /** @description External identifiers associated with this user */
+            identifier: components["schemas"]["ExternalIDResponse"][];
+            /**
+             * Format: email
+             * @example user@example.com
+             */
+            email?: string;
+            /**
+             * Format: phone
+             * @description E.164 formatted phone number
+             * @example +1234567890
+             */
+            phone?: string;
+            /**
+             * @example {
+             *       "first_name": "John",
+             *       "last_name": "Doe"
+             *     }
+             */
+            data: {
+                [key: string]: unknown;
+            };
+            /** @example America/New_York */
+            timezone?: string;
+            /** @example en */
+            locale?: string;
+            /** @example false */
+            has_push_device: boolean;
+            /** @example 1 */
+            version: number;
+            /**
+             * Format: date-time
+             * @example 2025-11-19T14:18:42.960Z
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @example 2025-11-23T17:20:00.021Z
+             */
+            updated_at: string;
+        };
+        /** @description One or more external identifiers to identify the user */
+        UserIdentifier: components["schemas"]["ExternalID"][];
+        /** @description One or more external identifiers to identify the organization */
+        OrganizationIdentifier: components["schemas"]["ExternalID"][];
+        DeviceRegistration: {
+            identifier: components["schemas"]["UserIdentifier"];
+            device_id: string;
+            /** @enum {string} */
+            os?: "web" | "ios" | "android";
+            os_version?: string;
+            model?: string;
+            app_version?: string;
+            /**
+             * @example {
+             *       "app_channel": "beta",
+             *       "locale": "en-US"
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+            config: {
+                /** @description Device token for FCM or APNs */
+                token?: string;
+                /** @description Web Push subscription endpoint URL */
+                endpoint?: string;
+                /** Format: date-time */
+                expiration_time?: string;
+                keys?: {
+                    p256dh: string;
+                    auth: string;
+                };
+            };
+        };
+        VapidPublicKey: {
+            /** @description The VAPID public key */
+            public_key: string;
+        };
+        IdentifyRequest: {
+            identifier: components["schemas"]["UserIdentifier"];
+            /**
+             * Format: email
+             * @example user@example.com
+             */
+            email?: string | null;
+            /**
+             * Format: phone
+             * @description E.164 formatted phone number
+             * @example +31612345678
+             */
+            phone?: string | null;
+            /** @example Europe/Amsterdam */
+            timezone?: string | null;
+            /** @example nl-NL */
+            locale?: string | null;
+            /**
+             * @description User-specific attributes
+             * @example {
+             *       "first_name": "John",
+             *       "last_name": "Smith",
+             *       "has_completed_onboarding": true
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        PostEventsRequest: components["schemas"]["Event"][];
+        Event: {
+            /**
+             * @description The name of the event
+             * @example purchase_completed
+             */
+            name: string;
+            identifier?: components["schemas"]["UserIdentifier"];
+            /**
+             * @description JSONB containment filter to match users by their data attributes. Mutually exclusive with identifier. When set, the event is delivered to every user whose data column contains the given key/value pairs.
+             * @example {
+             *       "plan": "enterprise"
+             *     }
+             */
+            match?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * @description Event-specific data
+             * @example {
+             *       "product_id": "prod_789",
+             *       "amount": 99.99
+             *     }
+             */
+            data: {
+                [key: string]: unknown;
+            };
+        };
+        InboxMessageCreate: {
+            target: components["schemas"]["UserIdentifier"];
+            /** @description External identifier for the message. Required for idempotency and traceability back to the origin source. */
+            identifier: components["schemas"]["ExternalID"];
+            channel: components["schemas"]["Channel"];
+            /**
+             * Format: uuid
+             * @description Required for email and sms messages. Push uses project push provider settings.
+             */
+            sender_identity_id?: string | null;
+            /** Format: uuid */
+            campaign_id?: string | null;
+            /** Format: uuid */
+            broadcast_id?: string | null;
+            /** @description Channel-specific payload content. */
+            content?: {
+                [key: string]: unknown;
+            } | null;
+            data?: {
+                [key: string]: unknown;
+            } | null;
+            tags?: string[];
+            /** @default 3 */
+            priority: number;
+            source?: string | null;
+            /** Format: date-time */
+            scheduled_at?: string | null;
+            /** Format: date-time */
+            expires_at?: string | null;
+        };
+        OrganizationInboxMessageCreate: {
+            target: components["schemas"]["OrganizationIdentifier"];
+            /** @description External identifier for the message. Required for idempotency and traceability back to the origin source. */
+            identifier: components["schemas"]["ExternalID"];
+            channel: components["schemas"]["Channel"];
+            /**
+             * Format: uuid
+             * @description Required for email and sms messages. Push uses project push provider settings.
+             */
+            sender_identity_id?: string | null;
+            /** Format: uuid */
+            campaign_id?: string | null;
+            /** Format: uuid */
+            broadcast_id?: string | null;
+            /** @description Channel-specific payload content. */
+            content?: {
+                [key: string]: unknown;
+            } | null;
+            data?: {
+                [key: string]: unknown;
+            } | null;
+            tags?: string[];
+            /** @default 3 */
+            priority: number;
+            source?: string | null;
+            /** Format: date-time */
+            scheduled_at?: string | null;
+            /** Format: date-time */
+            expires_at?: string | null;
+        };
+        PostUserInboxMessagesRequest: components["schemas"]["InboxMessageCreate"][];
+        PostOrganizationInboxMessagesRequest: components["schemas"]["OrganizationInboxMessageCreate"][];
+        UserInboxMessageRef: {
+            target: components["schemas"]["UserIdentifier"];
+            /** Format: uuid */
+            message_id: string;
+        };
+        OrganizationInboxMessageRef: {
+            target: components["schemas"]["OrganizationIdentifier"];
+            /** Format: uuid */
+            message_id: string;
+        };
+        UserInboxMessageEvents: components["schemas"]["UserInboxMessageRef"][];
+        OrganizationInboxMessageEvents: components["schemas"]["OrganizationInboxMessageRef"][];
+        InboxMessage: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            project_id: string;
+            /** Format: uuid */
+            user_id?: string;
+            /** Format: uuid */
+            organization_id?: string;
+            /** @description External identifier for the message, if one was provided at creation time. */
+            external_id?: string | null;
+            channel: components["schemas"]["Channel"];
+            /** Format: uuid */
+            sender_identity_id?: string | null;
+            /** Format: uuid */
+            campaign_id?: string | null;
+            /** Format: uuid */
+            broadcast_id?: string | null;
+            content: {
+                [key: string]: unknown;
+            };
+            data: {
+                [key: string]: unknown;
+            };
+            tags: string[];
+            priority: number;
+            source?: string | null;
+            /** Format: date-time */
+            scheduled_at: string;
+            /** Format: date-time */
+            expires_at?: string | null;
+            /** Format: date-time */
+            read_at?: string | null;
+            /** Format: date-time */
+            archived_at?: string | null;
+            /** Format: date-time */
+            sent_at?: string | null;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            updated_at: string;
+        };
+        InboxMessageList: {
+            results: components["schemas"]["InboxMessage"][];
+            total: number;
+            limit: number;
+            offset: number;
+        };
+        InboxCount: {
+            unread: number;
+            total: number;
+        };
+        Organization: {
+            /**
+             * Format: uuid
+             * @example 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @example 4c9d3163-7b64-4f9e-9068-d2e4b96be56b
+             */
+            project_id: string;
+            /** @description External identifiers associated with this organization */
+            identifier: components["schemas"]["ExternalIDResponse"][];
+            /** @example Acme Corp */
+            name?: string;
+            /**
+             * @example {
+             *       "industry": "technology",
+             *       "size": "enterprise"
+             *     }
+             */
+            data: {
+                [key: string]: unknown;
+            };
+            /** @example 1 */
+            version: number;
+            /**
+             * Format: date-time
+             * @example 2025-11-19T14:18:42.960Z
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @example 2025-11-23T17:20:00.021Z
+             */
+            updated_at: string;
+        };
+        OrganizationRequest: {
+            identifier: components["schemas"]["OrganizationIdentifier"];
+            /** @example Acme Corp */
+            name?: string | null;
+            /**
+             * @example {
+             *       "industry": "technology",
+             *       "size": "enterprise"
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        OrganizationUserRequest: {
+            organization: {
+                identifier: components["schemas"]["OrganizationIdentifier"];
+            };
+            user: {
+                identifier: components["schemas"]["UserIdentifier"];
+            };
+            /**
+             * @description Organization-specific data for this user
+             * @example {
+             *       "role": "admin",
+             *       "department": "engineering"
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        DeleteUserRequest: {
+            identifier: components["schemas"]["UserIdentifier"];
+        };
+        DeleteOrganizationRequest: {
+            identifier: components["schemas"]["OrganizationIdentifier"];
+        };
+        RemoveOrganizationUserRequest: {
+            organization: {
+                identifier: components["schemas"]["OrganizationIdentifier"];
+            };
+            user: {
+                identifier: components["schemas"]["UserIdentifier"];
+            };
+        };
+        PostOrganizationEventsRequest: components["schemas"]["OrganizationEvent"][];
+        OrganizationEvent: {
+            identifier?: components["schemas"]["OrganizationIdentifier"];
+            /**
+             * @description JSONB containment filter to match organizations by their data attributes. Mutually exclusive with identifier. When set, the event is delivered to every organization whose data column contains the given key/value pairs.
+             * @example {
+             *       "plan": "enterprise"
+             *     }
+             */
+            match?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * @description The name of the event
+             * @example subscription_upgraded
+             */
+            name: string;
+            /**
+             * @description Event-specific data
+             * @example {
+             *       "plan": "enterprise",
+             *       "seats": 100
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        UpsertUserScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource
+             * @example renewal_date
+             */
+            name: string;
+            identifier?: components["schemas"]["UserIdentifier"];
+            /**
+             * Format: date-time
+             * @description The time at which the scheduled resource is set to trigger. Required for single schedules.
+             * @example 2025-12-25T10:00:00Z
+             */
+            scheduled_at?: string | null;
+            /**
+             * Format: date-time
+             * @description Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+             * @example 2025-01-01T00:00:00Z
+             */
+            start_at?: string | null;
+            /**
+             * @description Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+             * @example 24h
+             */
+            interval?: string | null;
+            /**
+             * @description Scheduled resource data
+             * @example {
+             *       "plan": "pro",
+             *       "amount": 29.99
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        UpsertOrganizationScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource
+             * @example contract_renewal
+             */
+            name: string;
+            identifier: components["schemas"]["OrganizationIdentifier"];
+            /**
+             * Format: date-time
+             * @description The time at which the scheduled resource is set to trigger. Required for single schedules.
+             * @example 2025-12-25T10:00:00Z
+             */
+            scheduled_at?: string | null;
+            /**
+             * Format: date-time
+             * @description Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+             * @example 2025-01-01T00:00:00Z
+             */
+            start_at?: string | null;
+            /**
+             * @description Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+             * @example 24h
+             */
+            interval?: string | null;
+            /**
+             * @description Scheduled resource data
+             * @example {
+             *       "contract_type": "enterprise",
+             *       "seats": 100
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        DeleteUserScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource to delete
+             * @example renewal_date
+             */
+            name: string;
+            identifier?: components["schemas"]["UserIdentifier"];
+        };
+        ScheduledAccepted: {
+            /**
+             * Format: uuid
+             * @description The unique identifier for the scheduled instance
+             * @example a1b2c3d4-e5f6-7890-abcd-ef1234567890
+             */
+            id: string;
+            /**
+             * @description The name of the scheduled resource
+             * @example trial_end
+             */
+            name: string;
+            /**
+             * Format: date-time
+             * @description The time at which the scheduled resource is set to trigger
+             * @example 2025-01-15T09:00:00Z
+             */
+            scheduled_at: string;
+            /** @description Scheduled resource data */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        DeleteOrganizationScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource to delete
+             * @example contract_renewal
+             */
+            name: string;
+            identifier: components["schemas"]["OrganizationIdentifier"];
+        };
+    };
+    responses: {
+        /** @description Error response */
+        Error: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Problem"];
+            };
+        };
+    };
+    parameters: {
+        /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+        ProjectID: string;
+        /** @description Maximum number of items to return */
+        Limit: number;
+        /** @description Number of items to skip */
+        Offset: number;
+    };
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    upsertUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["IdentifyRequest"];
+            };
+        };
+        responses: {
+            /** @description User upserted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["User"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteUserRequest"];
+            };
+        };
+        responses: {
+            /** @description User deleted successfully */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserEvents: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostEventsRequest"];
+            };
+        };
+        responses: {
+            /** @description Events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getUserInbox: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                status?: "unread" | "read" | "archived";
+                /** @description Comma-separated tag filter. All listed tags must be present. */
+                tags?: string;
+                message_source?: string;
+                priority?: number;
+                channel: components["schemas"]["Channel"];
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["Limit"];
+                /** @description Number of items to skip */
+                offset?: components["parameters"]["Offset"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User inbox messages retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxMessageList"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserInboxMessages: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostUserInboxMessagesRequest"];
+            };
+        };
+        responses: {
+            /** @description Inbox messages accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getUserInboxCount: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                channel: components["schemas"]["Channel"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User inbox count retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxCount"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserInboxRead: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UserInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox read events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserInboxArchived: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UserInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox archived events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    upsertOrganizationClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationRequest"];
+            };
+        };
+        responses: {
+            /** @description Organization upserted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteOrganizationClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteOrganizationRequest"];
+            };
+        };
+        responses: {
+            /** @description Organization deleted successfully */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    addOrganizationUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationUserRequest"];
+            };
+        };
+        responses: {
+            /** @description User added to organization successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    removeOrganizationUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RemoveOrganizationUserRequest"];
+            };
+        };
+        responses: {
+            /** @description User removed from organization successfully */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    upsertUserScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpsertUserScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description Scheduled resource accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ScheduledAccepted"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteUserScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteUserScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description User scheduled deleted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    upsertOrganizationScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpsertOrganizationScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description Scheduled resource accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ScheduledAccepted"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteOrganizationScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteOrganizationScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description Organization scheduled deleted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationEventsClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostOrganizationEventsRequest"];
+            };
+        };
+        responses: {
+            /** @description Events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getOrganizationInbox: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                status?: "unread" | "read" | "archived";
+                /** @description Comma-separated tag filter. All listed tags must be present. */
+                tags?: string;
+                message_source?: string;
+                priority?: number;
+                channel: components["schemas"]["Channel"];
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["Limit"];
+                /** @description Number of items to skip */
+                offset?: components["parameters"]["Offset"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization inbox messages retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxMessageList"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationInboxMessages: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostOrganizationInboxMessagesRequest"];
+            };
+        };
+        responses: {
+            /** @description Inbox messages accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getOrganizationInboxCount: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                channel: components["schemas"]["Channel"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization inbox count retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxCount"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationInboxRead: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox read events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationInboxArchived: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox archived events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    emailUnsubscribe: {
+        parameters: {
+            query: {
+                /** @description Encoded unsubscribe link with user and campaign data */
+                link: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Unsubscribe confirmation page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+        };
+    };
+    getPreferencesPage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project ID */
+                projectID: string;
+                /** @description The user ID */
+                userID: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Subscription preferences page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+        };
+    };
+    updatePreferences: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project ID */
+                projectID: string;
+                /** @description The user ID */
+                userID: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": {
+                    /** @description Array of subscription IDs to keep subscribed */
+                    subscriptionIds?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Success response (for htmx partial updates) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+            /** @description Redirect to preferences page with success indicator */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    registerDevice: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeviceRegistration"];
+            };
+        };
+        responses: {
+            /** @description Device registered successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getVapidPublicKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description VAPID public key retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VapidPublicKey"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    createSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+                /** @description The session auth method (policy) that defines what the session may do. */
+                authMethodID: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSession"];
+            };
+        };
+        responses: {
+            /** @description Session token minted successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SessionToken"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+}
diff --git a/src/index.ts b/src/index.ts
index c4d8915..0712827 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -2,7 +2,7 @@ import { BrowserClient } from './platform/browser'
 import { ClientNamespace } from './core/factory'
 
 export * from './core/client'
-export * from './core/http'
+export * from './core/transport'
 export * from './core/errors'
 export * from './core/resources'
 export * from './types'
@@ -17,10 +17,12 @@ export class Lunogram {
     /**
      * Creates a new Lunogram instance.
      * @param apiKey - Your Lunogram API key
+     * @param projectId - The UUID of your Lunogram project (required). All
+     *                    Client API requests are scoped to this project.
      * @param urlEndpoint - Optional custom API endpoint URL
      */
-    constructor(apiKey: string, urlEndpoint?: string) {
-        this.client = new BrowserClient({ apiKey, urlEndpoint })
+    constructor(apiKey: string, projectId: string, urlEndpoint?: string) {
+        this.client = new BrowserClient({ apiKey, projectId, urlEndpoint })
     }
 
     /**
@@ -36,6 +38,20 @@ export class Lunogram {
     get organization(): ClientNamespace['organization'] {
         return this.client.organization
     }
+
+    /**
+     * Access push notification configuration (e.g. the VAPID public key).
+     */
+    get push(): ClientNamespace['push'] {
+        return this.client.push
+    }
+
+    /**
+     * Access session token minting for end users.
+     */
+    get sessions(): ClientNamespace['sessions'] {
+        return this.client.sessions
+    }
 }
 
 declare global {
diff --git a/src/platform/browser.ts b/src/platform/browser.ts
index 99e068c..7e952eb 100644
--- a/src/platform/browser.ts
+++ b/src/platform/browser.ts
@@ -2,7 +2,7 @@ import { Client } from '../core/client'
 import { ClientProps, ExternalID } from '../types'
 import { generateUuid } from '../utils'
 import { UserResource } from '../core/resources/users/user'
-import { HttpHandler } from '../core/http'
+import { Transport } from '../core/transport'
 import {
     UpsertUserRequest,
     DeleteUserRequest,
@@ -12,15 +12,17 @@ import {
     UpsertUserScheduledRequest,
     DeleteUserScheduledRequest,
     ScheduledAcceptedResponse,
+    DeviceRegistration,
 } from '../types'
 import { UserEventsResource } from '../core/resources/users/events'
 import { UserScheduledResource } from '../core/resources/users/scheduled'
+import { UserDevicesResource } from '../core/resources/users/devices'
 
 class BrowserUserEventsResource extends UserEventsResource {
     readonly #getIdentifier: () => UserIdentifier
 
-    constructor(http: HttpHandler, getIdentifier: () => UserIdentifier) {
-        super(http)
+    constructor(transport: Transport, getIdentifier: () => UserIdentifier) {
+        super(transport)
         this.#getIdentifier = getIdentifier
     }
 
@@ -38,8 +40,8 @@ class BrowserUserEventsResource extends UserEventsResource {
 class BrowserUserScheduledResource extends UserScheduledResource {
     readonly #getIdentifier: () => UserIdentifier
 
-    constructor(http: HttpHandler, getIdentifier: () => UserIdentifier) {
-        super(http)
+    constructor(transport: Transport, getIdentifier: () => UserIdentifier) {
+        super(transport)
         this.#getIdentifier = getIdentifier
     }
 
@@ -58,6 +60,24 @@ class BrowserUserScheduledResource extends UserScheduledResource {
     }
 }
 
+class BrowserUserDevicesResource extends UserDevicesResource {
+    readonly #getIdentifier: () => UserIdentifier
+
+    constructor(transport: Transport, getIdentifier: () => UserIdentifier) {
+        super(transport)
+        this.#getIdentifier = getIdentifier
+    }
+
+    async register(
+        data: Omit<DeviceRegistration, 'identifier'> & { identifier?: UserIdentifier },
+    ): Promise<void> {
+        return super.register({
+            ...data,
+            identifier: data.identifier ?? this.#getIdentifier(),
+        })
+    }
+}
+
 class BrowserUserResource extends UserResource {
     readonly #anonymousId: string
     /**
@@ -69,12 +89,14 @@ class BrowserUserResource extends UserResource {
     #externalId?: string
     override readonly events: BrowserUserEventsResource
     override readonly schedule: BrowserUserScheduledResource
+    override readonly devices: BrowserUserDevicesResource
 
-    constructor(http: HttpHandler) {
-        super(http)
+    constructor(transport: Transport) {
+        super(transport)
         this.#anonymousId = generateUuid()
-        this.events = new BrowserUserEventsResource(http, () => this.#buildIdentifier())
-        this.schedule = new BrowserUserScheduledResource(http, () => this.#buildIdentifier())
+        this.events = new BrowserUserEventsResource(transport, () => this.#buildIdentifier())
+        this.schedule = new BrowserUserScheduledResource(transport, () => this.#buildIdentifier())
+        this.devices = new BrowserUserDevicesResource(transport, () => this.#buildIdentifier())
     }
 
     #buildIdentifier(extraIdentifiers?: UserIdentifier): UserIdentifier {
@@ -139,6 +161,6 @@ export class BrowserClient extends Client {
 
     constructor(props: ClientProps) {
         super(props)
-        this.user = new BrowserUserResource(super.httpHandler)
+        this.user = new BrowserUserResource(super.transport)
     }
 }
diff --git a/src/types/common.ts b/src/types/common.ts
index 112edfe..984b65e 100644
--- a/src/types/common.ts
+++ b/src/types/common.ts
@@ -2,5 +2,10 @@ export type JSONValue = string | number | boolean | null | { [key: string]: JSON
 
 export interface ClientProps {
     apiKey: string
+    /**
+     * The UUID of the Lunogram project. Required. Every Client API request is
+     * scoped to this project and issued under `/client/projects/{projectId}/...`.
+     */
+    projectId: string
     urlEndpoint?: string
 }
diff --git a/src/types/device.ts b/src/types/device.ts
new file mode 100644
index 0000000..0608f75
--- /dev/null
+++ b/src/types/device.ts
@@ -0,0 +1,38 @@
+import { JSONValue } from './common'
+import { UserIdentifier } from './request'
+
+/** Operating system a registered device runs on. */
+export type DeviceOS = 'web' | 'ios' | 'android'
+
+/** Web Push subscription keys. */
+export interface DeviceKeys {
+    p256dh: string
+    auth: string
+}
+
+/** Transport configuration for a device's push subscription. */
+export interface DeviceConfig {
+    /** Device token for FCM or APNs. */
+    token?: string
+    /** Web Push subscription endpoint URL. */
+    endpoint?: string
+    expirationTime?: string | null
+    keys?: DeviceKeys
+}
+
+/** Request to register or update a device's push subscription for a user. */
+export interface DeviceRegistration {
+    identifier: UserIdentifier
+    deviceId: string
+    config: DeviceConfig
+    os?: DeviceOS
+    osVersion?: string
+    model?: string
+    appVersion?: string
+    data?: Record<string, JSONValue> | null
+}
+
+/** The project's VAPID public key for Web Push. */
+export interface VapidPublicKey {
+    publicKey: string
+}
diff --git a/src/types/inbox.ts b/src/types/inbox.ts
new file mode 100644
index 0000000..e054a0d
--- /dev/null
+++ b/src/types/inbox.ts
@@ -0,0 +1,111 @@
+import { JSONValue } from './common'
+import { ExternalID, UserIdentifier, OrganizationIdentifier } from './request'
+
+/** Delivery channel for an inbox message. */
+export type Channel = 'email' | 'sms' | 'push' | 'inbox'
+
+/** Visibility status used to filter inbox queries. */
+export type InboxStatus = 'unread' | 'read' | 'archived'
+
+/** Fields shared by user and organization inbox message creation. */
+interface InboxMessageCreateBase {
+    /** External identifier for the message. Required for idempotency and traceability back to the origin source. */
+    identifier: ExternalID
+    channel: Channel
+    /** Required for email and sms messages. Push uses project push provider settings. */
+    senderIdentityId?: string | null
+    campaignId?: string | null
+    broadcastId?: string | null
+    /** Channel-specific payload content. */
+    content?: Record<string, JSONValue> | null
+    data?: Record<string, JSONValue> | null
+    tags?: string[]
+    /** Message priority from 1 (highest) to 5 (lowest). Defaults to 3. */
+    priority?: number
+    source?: string | null
+    scheduledAt?: string | null
+    expiresAt?: string | null
+}
+
+/** Request to create an inbox message for a user. */
+export interface InboxMessageCreate extends InboxMessageCreateBase {
+    target: UserIdentifier
+}
+
+/** Request to create an inbox message for an organization. */
+export interface OrganizationInboxMessageCreate extends InboxMessageCreateBase {
+    target: OrganizationIdentifier
+}
+
+/** An inbox message as returned by the API. */
+export interface InboxMessage {
+    id: string
+    projectId: string
+    userId?: string
+    organizationId?: string
+    /** External identifier for the message, if one was provided at creation time. */
+    externalId?: string | null
+    channel: Channel
+    senderIdentityId?: string | null
+    campaignId?: string | null
+    broadcastId?: string | null
+    content: Record<string, JSONValue>
+    data: Record<string, JSONValue>
+    tags: string[]
+    priority: number
+    source?: string | null
+    scheduledAt: string
+    expiresAt?: string | null
+    readAt?: string | null
+    archivedAt?: string | null
+    sentAt?: string | null
+    createdAt: string
+    updatedAt: string
+}
+
+/** A paginated list of inbox messages. */
+export interface InboxMessageList {
+    results: InboxMessage[]
+    total: number
+    limit: number
+    offset: number
+}
+
+/** Unread and total visible message counts for an inbox. */
+export interface InboxCount {
+    unread: number
+    total: number
+}
+
+/** Reference to a single user inbox message, used by read/archive operations. */
+export interface UserInboxMessageRef {
+    target: UserIdentifier
+    messageId: string
+}
+
+/** Reference to a single organization inbox message, used by read/archive operations. */
+export interface OrganizationInboxMessageRef {
+    target: OrganizationIdentifier
+    messageId: string
+}
+
+/** Filter for querying an inbox. `source`, `externalId` and `channel` are required. */
+export interface InboxQuery {
+    source: string
+    externalId: string
+    channel: Channel
+    status?: InboxStatus
+    /** Comma-separated tag filter. All listed tags must be present. */
+    tags?: string
+    messageSource?: string
+    priority?: number
+    limit?: number
+    offset?: number
+}
+
+/** Filter for counting inbox messages. All fields are required. */
+export interface InboxCountQuery {
+    source: string
+    externalId: string
+    channel: Channel
+}
diff --git a/src/types/index.ts b/src/types/index.ts
index a2bb2c8..baf9db1 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -1,3 +1,6 @@
 export * from './common'
 export * from './request'
 export * from './scheduled'
+export * from './inbox'
+export * from './device'
+export * from './session'
diff --git a/src/types/session.ts b/src/types/session.ts
new file mode 100644
index 0000000..4ecd1f0
--- /dev/null
+++ b/src/types/session.ts
@@ -0,0 +1,11 @@
+/** Request to mint a session token for an end user. */
+export interface CreateSessionRequest {
+    /** The end user's external identifier (the session subject). */
+    userId: string
+}
+
+/** A minted session token (a bearer token for the Client API). */
+export interface SessionToken {
+    token: string
+    expiresAt: string
+}
diff --git a/src/utils/crypto.ts b/src/utils/crypto.ts
index 336105f..b438172 100644
--- a/src/utils/crypto.ts
+++ b/src/utils/crypto.ts
@@ -1,5 +1,9 @@
-import { v4 as uuidv4 } from 'uuid'
+import { v4 as uuidv4, validate as uuidValidate } from 'uuid'
 
 export function generateUuid(): string {
     return uuidv4()
 }
+
+export function isUuid(value: string): boolean {
+    return uuidValidate(value)
+}
diff --git a/test/browser.test.ts b/test/browser.test.ts
new file mode 100644
index 0000000..b54628e
--- /dev/null
+++ b/test/browser.test.ts
@@ -0,0 +1,123 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Lunogram } from '../src'
+
+const apiKey = 'test-api-key'
+const projectId = '11111111-1111-4111-8111-111111111111'
+const urlEndpoint = 'https://api.example.com/api'
+
+function mockFetch() {
+    return vi.fn(async () =>
+        new Response(JSON.stringify({}), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        }),
+    )
+}
+
+describe('Browser identifier injection', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    async function lastBody() {
+        const call = fetchMock.mock.calls.at(-1)
+        return (call?.[0] as Request).clone().json()
+    }
+
+    const isAnon = (i: { source: string }) => i.source === 'anonymous'
+
+    it('injects an auto-generated anonymous identifier on upsert', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.upsert({ identifier: [{ externalId: 'user-1' }], email: 'a@b.com' })
+
+        const body = await lastBody()
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ source: 'anonymous' }),
+                expect.objectContaining({ source: 'default', external_id: 'user-1' }),
+            ]),
+        )
+        // the anonymous identifier value is a stable, non-empty session id
+        const anon = body.identifier.find(isAnon)
+        expect(typeof anon.external_id).toBe('string')
+        expect(anon.external_id.length).toBeGreaterThan(0)
+    })
+
+    it('makes the default external id sticky across subsequent calls', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        // identify once
+        await lunogram.user.upsert({ identifier: [{ externalId: 'user-1' }] })
+        // a later event carries no identifier — the SDK injects anonymous + sticky default
+        await lunogram.user.events.post([{ name: 'page_viewed', data: {} }])
+
+        const body = await lastBody()
+        expect(body[0].identifier).toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ source: 'anonymous' }),
+                expect.objectContaining({ source: 'default', external_id: 'user-1' }),
+            ]),
+        )
+    })
+
+    it('keeps the same anonymous id stable between calls', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.upsert({ identifier: [{ externalId: 'a' }] })
+        const first = (await lastBody()).identifier.find(isAnon).external_id
+        await lunogram.user.upsert({ identifier: [{ externalId: 'b' }] })
+        const second = (await lastBody()).identifier.find(isAnon).external_id
+        expect(second).toBe(first)
+    })
+
+    it('does NOT inject an identifier into match-based events', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.events.post([{ name: 'evt', match: { plan: 'pro' }, data: {} }])
+
+        const body = await lastBody()
+        expect(body[0].identifier).toBeUndefined()
+        expect(body[0].match).toEqual({ plan: 'pro' })
+    })
+
+    it('injects the session identifier into scheduled resources', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.schedule.upsert({ name: 'trial_end', scheduledAt: '2025-12-25T10:00:00Z' })
+
+        const body = await lastBody()
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([expect.objectContaining({ source: 'anonymous' })]),
+        )
+    })
+
+    it('injects the session identifier into device registration', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.devices.register({ deviceId: 'device-1', config: { token: 'tok' } })
+
+        const body = await lastBody()
+        expect(body.device_id).toBe('device-1')
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([expect.objectContaining({ source: 'anonymous' })]),
+        )
+    })
+
+    it('merges a caller-supplied identifier with the anonymous one', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.upsert({
+            identifier: [{ source: 'stripe', externalId: 'cus_123' }],
+        })
+
+        const body = await lastBody()
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ source: 'anonymous' }),
+                expect.objectContaining({ source: 'stripe', external_id: 'cus_123' }),
+            ]),
+        )
+    })
+})
diff --git a/test/e2e.test.ts b/test/e2e.test.ts
index f9569f2..e0a50e7 100644
--- a/test/e2e.test.ts
+++ b/test/e2e.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeAll } from 'vitest'
 import { Client } from '../src'
 
 const apiKey = process.env.LUNOGRAM_API_KEY
+const projectId = process.env.LUNOGRAM_PROJECT_ID
 const urlEndpoint = process.env.LUNOGRAM_API_URL
 
 const userId = `test-user-${Date.now()}`
@@ -13,7 +14,10 @@ beforeAll(() => {
     if (!apiKey) {
         throw new Error('LUNOGRAM_API_KEY environment variable is required')
     }
-    client = new Client({ apiKey, urlEndpoint })
+    if (!projectId) {
+        throw new Error('LUNOGRAM_PROJECT_ID environment variable is required')
+    }
+    client = new Client({ apiKey, projectId, urlEndpoint })
 })
 
 describe('Users', () => {
diff --git a/test/url.test.ts b/test/url.test.ts
new file mode 100644
index 0000000..726b9ef
--- /dev/null
+++ b/test/url.test.ts
@@ -0,0 +1,305 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Client, ValidationError } from '../src'
+
+const apiKey = 'test-api-key'
+const projectId = '11111111-1111-4111-8111-111111111111'
+const urlEndpoint = 'https://api.example.com/api'
+
+function mockFetch() {
+    return vi.fn(async () =>
+        new Response(JSON.stringify({}), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        }),
+    )
+}
+
+describe('Client API URL construction', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    // openapi-fetch invokes the global fetch with a `Request` object rather
+    // than a URL string, so read the resolved URL off the request's `.url`.
+    function urlOf(input: unknown): string {
+        if (input instanceof Request) {
+            return input.url
+        }
+        return String(input)
+    }
+
+    function lastUrl(): string {
+        const call = fetchMock.mock.calls.at(-1)
+        return urlOf(call?.[0])
+    }
+
+    it('prefixes user requests with /client/projects/{projectId}', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({ identifier: [{ externalId: 'user-1' }] })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/users`)
+    })
+
+    it('prefixes user events', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.events.post([{ name: 'evt', identifier: [{ externalId: 'u' }], data: {} }])
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/users/events`)
+    })
+
+    it('prefixes user scheduled', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.schedule.upsert({
+            name: 'r',
+            identifier: [{ externalId: 'u' }],
+            scheduledAt: new Date().toISOString(),
+        })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/users/scheduled`)
+    })
+
+    it('prefixes organizations', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.organization.upsert({ identifier: [{ externalId: 'org-1' }] })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/organizations`)
+    })
+
+    it('prefixes organization member operations (path override)', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.organization.addUser({
+            organization: { identifier: [{ externalId: 'org-1' }] },
+            user: { identifier: [{ externalId: 'user-1' }] },
+        })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/organizations/users`)
+    })
+
+    it('prefixes organization events', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.organization.events.post([{ name: 'evt', identifier: [{ externalId: 'o' }], data: {} }])
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/organizations/events`)
+    })
+
+    it('does not double-prefix on repeated calls', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({ identifier: [{ externalId: 'a' }] })
+        await client.user.upsert({ identifier: [{ externalId: 'b' }] })
+        for (const call of fetchMock.mock.calls) {
+            expect(urlOf(call[0])).toBe(`${urlEndpoint}/client/projects/${projectId}/users`)
+        }
+    })
+})
+
+describe('request encoding', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    async function lastRequest(): Promise<Request> {
+        const call = fetchMock.mock.calls.at(-1)
+        return call?.[0] as Request
+    }
+
+    it('sends the Bearer auth header', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({ identifier: [{ externalId: 'user-1' }] })
+        const request = await lastRequest()
+        expect(request.headers.get('Authorization')).toBe(`Bearer ${apiKey}`)
+    })
+
+    it('maps the camelCase facade payload to snake_case on the wire', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({
+            identifier: [{ externalId: 'user-1' }],
+            email: 'a@b.com',
+        })
+        const body = await (await lastRequest()).clone().json()
+        expect(body).toEqual({
+            identifier: [{ external_id: 'user-1' }],
+            email: 'a@b.com',
+        })
+    })
+})
+
+describe('extended Client API endpoints', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    function lastUrl(): string {
+        const call = fetchMock.mock.calls.at(-1)
+        const input = call?.[0]
+        return input instanceof Request ? input.url : String(input)
+    }
+
+    function lastPath(): string {
+        return new URL(lastUrl()).pathname
+    }
+
+    const base = `/api/client/projects/${projectId}`
+
+    it('prefixes user inbox create/query/count/read/archived', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.user.inbox.create([
+            { target: [{ externalId: 'u' }], identifier: { externalId: 'm1' }, channel: 'inbox' },
+        ])
+        expect(lastPath()).toBe(`${base}/users/inbox`)
+
+        await client.user.inbox.query({ source: 'default', externalId: 'u', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/users/inbox`)
+
+        await client.user.inbox.count({ source: 'default', externalId: 'u', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/users/inbox/count`)
+
+        await client.user.inbox.markRead([{ target: [{ externalId: 'u' }], messageId: 'm1' }])
+        expect(lastPath()).toBe(`${base}/users/inbox/read`)
+
+        await client.user.inbox.markArchived([{ target: [{ externalId: 'u' }], messageId: 'm1' }])
+        expect(lastPath()).toBe(`${base}/users/inbox/archived`)
+    })
+
+    it('maps inbox query params to snake_case on the wire', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.inbox.query({
+            source: 'default',
+            externalId: 'u',
+            channel: 'inbox',
+            messageSource: 'campaign',
+        })
+        const query = new URL(lastUrl()).searchParams
+        expect(query.get('external_id')).toBe('u')
+        expect(query.get('message_source')).toBe('campaign')
+        expect(query.get('channel')).toBe('inbox')
+    })
+
+    it('prefixes user device registration', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.devices.register({
+            identifier: [{ externalId: 'u' }],
+            deviceId: 'device-1',
+            config: { token: 'tok' },
+        })
+        expect(lastPath()).toBe(`${base}/users/devices`)
+    })
+
+    it('prefixes organization inbox operations', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.organization.inbox.create([
+            { target: [{ externalId: 'o' }], identifier: { externalId: 'm1' }, channel: 'inbox' },
+        ])
+        expect(lastPath()).toBe(`${base}/organizations/inbox`)
+
+        await client.organization.inbox.query({ source: 'default', externalId: 'o', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/organizations/inbox`)
+    })
+
+    it('prefixes the VAPID public key endpoint', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.push.getVapidPublicKey()
+        expect(lastPath()).toBe(`${base}/push/vapid`)
+    })
+
+    it('prefixes session minting with the auth method in the path', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        const authMethodId = '22222222-2222-4222-8222-222222222222'
+        await client.sessions.create(authMethodId, { userId: 'user-1' })
+        expect(lastPath()).toBe(`${base}/auth-methods/${authMethodId}/sessions`)
+    })
+
+    it('maps a session request body to snake_case on the wire', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.sessions.create('22222222-2222-4222-8222-222222222222', { userId: 'user-1' })
+        const call = fetchMock.mock.calls.at(-1)
+        const body = await (call?.[0] as Request).clone().json()
+        expect(body).toEqual({ user_id: 'user-1' })
+    })
+
+    function lastMethod(): string {
+        return (fetchMock.mock.calls.at(-1)?.[0] as Request).method
+    }
+
+    it('routes the remaining user + organization write endpoints', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.user.delete({ identifier: [{ externalId: 'u' }] })
+        expect(lastPath()).toBe(`${base}/users`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.user.schedule.delete({ name: 'r', identifier: [{ externalId: 'u' }] })
+        expect(lastPath()).toBe(`${base}/users/scheduled`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.organization.delete({ identifier: [{ externalId: 'o' }] })
+        expect(lastPath()).toBe(`${base}/organizations`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.organization.removeUser({
+            organization: { identifier: [{ externalId: 'o' }] },
+            user: { identifier: [{ externalId: 'u' }] },
+        })
+        expect(lastPath()).toBe(`${base}/organizations/users`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.organization.schedule.upsert({
+            name: 's',
+            identifier: [{ externalId: 'o' }],
+            scheduledAt: new Date().toISOString(),
+        })
+        expect(lastPath()).toBe(`${base}/organizations/scheduled`)
+        expect(lastMethod()).toBe('POST')
+
+        await client.organization.schedule.delete({ name: 's', identifier: [{ externalId: 'o' }] })
+        expect(lastPath()).toBe(`${base}/organizations/scheduled`)
+        expect(lastMethod()).toBe('DELETE')
+    })
+
+    it('routes the remaining organization inbox endpoints', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.organization.inbox.count({ source: 'default', externalId: 'o', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/organizations/inbox/count`)
+
+        await client.organization.inbox.markRead([{ target: [{ externalId: 'o' }], messageId: 'm' }])
+        expect(lastPath()).toBe(`${base}/organizations/inbox/read`)
+
+        await client.organization.inbox.markArchived([{ target: [{ externalId: 'o' }], messageId: 'm' }])
+        expect(lastPath()).toBe(`${base}/organizations/inbox/archived`)
+    })
+})
+
+describe('projectId validation', () => {
+    it('throws when projectId is missing', () => {
+        // @ts-expect-error projectId is required
+        expect(() => new Client({ apiKey, urlEndpoint })).toThrow(ValidationError)
+    })
+
+    it('throws when projectId is empty', () => {
+        expect(() => new Client({ apiKey, projectId: '   ', urlEndpoint })).toThrow(ValidationError)
+    })
+
+    it('throws when projectId is not a UUID', () => {
+        expect(() => new Client({ apiKey, projectId: 'not-a-uuid', urlEndpoint })).toThrow(ValidationError)
+    })
+})